You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

verify.sh 5.0KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179
  1. #!/bin/bash
  2. # Copyright (c) 2016 The Starwels developers
  3. # Distributed under the MIT software license, see the accompanying
  4. # file COPYING or http://www.opensource.org/licenses/mit-license.php.
  5. ### This script attempts to download the signature file SHA256SUMS.asc from
  6. ### github.com/starwels and github.com/starwels and compares them.
  7. ### It first checks if the signature passes, and then downloads the files specified in
  8. ### the file, and checks if the hashes of these files match those that are specified
  9. ### in the signature file.
  10. ### The script returns 0 if everything passes the checks. It returns 1 if either the
  11. ### signature check or the hash check doesn't pass. If an error occurs the return value is 2
  12. function clean_up {
  13. for file in $*
  14. do
  15. rm "$file" 2> /dev/null
  16. done
  17. }
  18. WORKINGDIR="/tmp/starwels_verify_binaries"
  19. TMPFILE="hashes.tmp"
  20. SIGNATUREFILENAME="SHA256SUMS.asc"
  21. RCSUBDIR="test"
  22. HOST1="https://github.com/starwels"
  23. HOST2="https://github.com/starwels"
  24. BASEDIR="/bin/"
  25. VERSIONPREFIX="starwels-"
  26. RCVERSIONSTRING="rc"
  27. if [ ! -d "$WORKINGDIR" ]; then
  28. mkdir "$WORKINGDIR"
  29. fi
  30. cd "$WORKINGDIR"
  31. #test if a version number has been passed as an argument
  32. if [ -n "$1" ]; then
  33. #let's also check if the version number includes the prefix 'starwels-',
  34. # and add this prefix if it doesn't
  35. if [[ $1 == "$VERSIONPREFIX"* ]]; then
  36. VERSION="$1"
  37. else
  38. VERSION="$VERSIONPREFIX$1"
  39. fi
  40. STRIPPEDLAST="${VERSION%-*}"
  41. #now let's see if the version string contains "rc" or a platform name (e.g. "osx")
  42. if [[ "$STRIPPEDLAST-" == "$VERSIONPREFIX" ]]; then
  43. BASEDIR="$BASEDIR$VERSION/"
  44. else
  45. # let's examine the last part to see if it's rc and/or platform name
  46. STRIPPEDNEXTTOLAST="${STRIPPEDLAST%-*}"
  47. if [[ "$STRIPPEDNEXTTOLAST-" == "$VERSIONPREFIX" ]]; then
  48. LASTSUFFIX="${VERSION##*-}"
  49. VERSION="$STRIPPEDLAST"
  50. if [[ $LASTSUFFIX == *"$RCVERSIONSTRING"* ]]; then
  51. RCVERSION="$LASTSUFFIX"
  52. else
  53. PLATFORM="$LASTSUFFIX"
  54. fi
  55. else
  56. RCVERSION="${STRIPPEDLAST##*-}"
  57. PLATFORM="${VERSION##*-}"
  58. VERSION="$STRIPPEDNEXTTOLAST"
  59. fi
  60. BASEDIR="$BASEDIR$VERSION/"
  61. if [[ $RCVERSION == *"$RCVERSIONSTRING"* ]]; then
  62. BASEDIR="$BASEDIR$RCSUBDIR.$RCVERSION/"
  63. fi
  64. fi
  65. SIGNATUREFILE="$BASEDIR$SIGNATUREFILENAME"
  66. else
  67. echo "Error: need to specify a version on the command line"
  68. exit 2
  69. fi
  70. #first we fetch the file containing the signature
  71. WGETOUT=$(wget -N "$HOST1$BASEDIR$SIGNATUREFILENAME" 2>&1)
  72. #and then see if wget completed successfully
  73. if [ $? -ne 0 ]; then
  74. echo "Error: couldn't fetch signature file. Have you specified the version number in the following format?"
  75. echo "[$VERSIONPREFIX]<version>-[$RCVERSIONSTRING[0-9]] (example: "$VERSIONPREFIX"0.10.4-"$RCVERSIONSTRING"1)"
  76. echo "wget output:"
  77. echo "$WGETOUT"|sed 's/^/\t/g'
  78. exit 2
  79. fi
  80. WGETOUT=$(wget -N -O "$SIGNATUREFILENAME.2" "$HOST2$BASEDIR$SIGNATUREFILENAME" 2>&1)
  81. if [ $? -ne 0 ]; then
  82. echo "github.com/starwels failed to provide signature file, but github.com/starwels did?"
  83. echo "wget output:"
  84. echo "$WGETOUT"|sed 's/^/\t/g'
  85. clean_up $SIGNATUREFILENAME
  86. exit 3
  87. fi
  88. SIGFILEDIFFS="$(diff $SIGNATUREFILENAME $SIGNATUREFILENAME.2)"
  89. if [ "$SIGFILEDIFFS" != "" ]; then
  90. echo "github.com/starwels and github.com/starwels signature files were not equal?"
  91. clean_up $SIGNATUREFILENAME $SIGNATUREFILENAME.2
  92. exit 4
  93. fi
  94. #then we check it
  95. GPGOUT=$(gpg --yes --decrypt --output "$TMPFILE" "$SIGNATUREFILENAME" 2>&1)
  96. #return value 0: good signature
  97. #return value 1: bad signature
  98. #return value 2: gpg error
  99. RET="$?"
  100. if [ $RET -ne 0 ]; then
  101. if [ $RET -eq 1 ]; then
  102. #and notify the user if it's bad
  103. echo "Bad signature."
  104. elif [ $RET -eq 2 ]; then
  105. #or if a gpg error has occurred
  106. echo "gpg error. Do you have the Starwels binary release signing key installed?"
  107. fi
  108. echo "gpg output:"
  109. echo "$GPGOUT"|sed 's/^/\t/g'
  110. clean_up $SIGNATUREFILENAME $SIGNATUREFILENAME.2 $TMPFILE
  111. exit "$RET"
  112. fi
  113. if [ -n "$PLATFORM" ]; then
  114. grep $PLATFORM $TMPFILE > "$TMPFILE-plat"
  115. TMPFILESIZE=$(stat -c%s "$TMPFILE-plat")
  116. if [ $TMPFILESIZE -eq 0 ]; then
  117. echo "error: no files matched the platform specified" && exit 3
  118. fi
  119. mv "$TMPFILE-plat" $TMPFILE
  120. fi
  121. #here we extract the filenames from the signature file
  122. FILES=$(awk '{print $2}' "$TMPFILE")
  123. #and download these one by one
  124. for file in $FILES
  125. do
  126. echo "Downloading $file"
  127. wget --quiet -N "$HOST1$BASEDIR$file"
  128. done
  129. #check hashes
  130. DIFF=$(diff <(sha256sum $FILES) "$TMPFILE")
  131. if [ $? -eq 1 ]; then
  132. echo "Hashes don't match."
  133. echo "Offending files:"
  134. echo "$DIFF"|grep "^<"|awk '{print "\t"$3}'
  135. exit 1
  136. elif [ $? -gt 1 ]; then
  137. echo "Error executing 'diff'"
  138. exit 2
  139. fi
  140. if [ -n "$2" ]; then
  141. echo "Clean up the binaries"
  142. clean_up $FILES $SIGNATUREFILENAME $SIGNATUREFILENAME.2 $TMPFILE
  143. else
  144. echo "Keep the binaries in $WORKINGDIR"
  145. clean_up $TMPFILE
  146. fi
  147. echo -e "Verified hashes of \n$FILES"
  148. exit 0