← Commit history

release.py: authenticated tier verify goes through the CLI (raw container bearer gets 403 on private-page files)

Colby Knox ·7f0d128f7f ·1mo ago ·parent 7c70f86
1 file changed +5−4
scripts/release.py+5−4
@@ -155,10 +155,11 @@ def two_curl_split_check():         anon_ok = e.code in (401, 403, 404)     if not anon_ok:         raise SystemExit(f"TIER LEAK: {INSIDERS_URL} is anonymously readable (or unreachable in an unexpected way)")-    token = Path("/var/run/adom/api-key").read_text().strip()-    req = urllib.request.Request(INSIDERS_URL, headers={"Authorization": f"Bearer {token}"})-    with urllib.request.urlopen(req, timeout=15) as r:-        served = json.loads(r.read())+    # the authenticated read goes through the CLI (its session auth is what insider desktops+    # use); a raw container bearer gets 403 on private-page file endpoints (measured 2026-09-02)+    out = subprocess.run(["adom-wiki", "api", "/api/v1/pages/insiders/files/altium-bridge/version.json"],+                         capture_output=True, text=True, check=True).stdout+    served = json.loads(out[out.find("{"):])     print(f"   two-curl split ok: anonymous blocked, bearer serves {served.get('version')}")     return served