Metadata-Version: 2.4
Name: teamsync-cluster
Version: 0.1.4
Summary: Verified licensed TeamSync kit bootstrap
Author: TeamSync
License: Proprietary
Project-URL: Documentation, https://pypi.org/project/teamsync-cluster/
Classifier: Programming Language :: Python :: 3
Classifier: Operating System :: OS Independent
Requires-Python: >=3.8
Description-Content-Type: text/markdown

# TeamSync cluster bootstrap

Python >=3.8, no Python runtime dependencies. Install GnuPG (`gpg`) on the
connected download machine. Target kits support Linux amd64 and arm64.

```sh
pip install teamsync-cluster
teamsync-cluster fetch --dest ./teamsync-download
# Hidden license prompt. Or --license-file /secure/license-key (0600), or
# TEAMSYNC_LICENSE_KEY from a secrets manager. --license KEY is also supported.
cd teamsync-download/kit
sudo ./teamsync-cluster config
sudo ./teamsync-cluster deploy --apply-firewall
sudo ./teamsync-cluster status
```

`fetch` redeems once, downloads base plus only the licensed add-ons, verifies
the pinned GPG release signature and every selected SHA-256, verifies the
separately signed offline license, then extracts. The destination contains a
private download receipt with expiring URLs; rerun the same fetch destination
to resume without redeeming again. Keep it private. An interrupted response
before that receipt is saved requires TeamSync support to issue a new key.

Copy the complete destination to an offline site. Run the kit's executable
there; Python >=3.10 is required by the full installer. Other bootstrap
subcommands delegate only to `TEAMSYNC_KIT` or the last successful download
path. The bootstrap checks user/root ownership, write permissions, the signed
license version/architecture and the executable hash in `components/base.json`.
Use an administrator-owned directory outside shared writable paths such as `/tmp`.

For a different target architecture: `fetch --arch amd64` or `--arch arm64`.
For a pinned grant: `fetch --version vX.Y.Z`. A `latest` grant resolves the
latest released version when redeemed. Additional add-ons require a new key.
Expired download links require a new key; they cannot be renewed by replay.
The license key is never written to the destination or printed by this tool.

An expired term leaves `status` and `doctor` available with a warning. `deploy`
can repair the exact configuration authorized before expiry; new installs or
add-on changes require renewal. To renew with a **new key** without changing the
installed version or downloading archives (on a connected machine):

```sh
teamsync-cluster fetch --license-only --kit ./teamsync-download/kit --license-file /secure/new-key
# For an offline site, copy only the renewed kit/license.json to the same kit.
```

Published builds contact production only and pin its signing authority. Staging
uses a separate operator-only build; endpoint/key environment overrides are refused.
