67e26be2d9
The public tree and its history contain only the listed paths. Earlier projection history remains preserved internally. Source-Sha: 913fde029b935671833254797f0f20f1eb9fabba Policy-Sha: 913fde029b935671833254797f0f20f1eb9fabba Tree-Digest: 180ae530c1058a2a5c89837bdce2d323ae83e669e38590ca72e75b8d92b7262f
58 lines
1.7 KiB
Shell
Executable file
58 lines
1.7 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "$#" -ne 5 ]; then
|
|
echo "usage: $0 <out-dir> <package-owner> <package-version> <receipt-sha256> <token-file>" >&2
|
|
exit 2
|
|
fi
|
|
|
|
out_dir=$1
|
|
package_owner=$2
|
|
package_version=$3
|
|
expected_receipt=$4
|
|
token_file=$5
|
|
|
|
if [[ ! $expected_receipt =~ ^[0-9a-f]{64}$ ]]; then
|
|
echo "candidate receipt must be a lowercase SHA-256 digest" >&2
|
|
exit 2
|
|
fi
|
|
|
|
case "$out_dir" in
|
|
''|/|.)
|
|
echo "refusing unsafe output directory: $out_dir" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
: "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
|
|
[ -r "$token_file" ] || { echo "package read token is unavailable" >&2; exit 1; }
|
|
|
|
package_read_token=$(<"$token_file")
|
|
[ -n "$package_read_token" ] || { echo "package read token is empty" >&2; exit 1; }
|
|
package_root="${GITHUB_SERVER_URL%/}/api/packages/$package_owner/generic/redflag-release/$package_version"
|
|
|
|
package_curl() {
|
|
curl --config <(printf 'silent\nshow-error\nheader = "Authorization: token %s"\n' "$package_read_token") "$@"
|
|
}
|
|
|
|
[ ! -e "$out_dir" ] && [ ! -L "$out_dir" ] || {
|
|
echo "candidate output already exists; choose a fresh directory" >&2
|
|
exit 1
|
|
}
|
|
mkdir -p "$out_dir"
|
|
package_curl -f -o "$out_dir/files.sha256" "$package_root/files.sha256"
|
|
|
|
actual_receipt=$(sha256sum "$out_dir/files.sha256" | awk '{print $1}')
|
|
if [ "$actual_receipt" != "$expected_receipt" ]; then
|
|
echo "candidate receipt mismatch" >&2
|
|
exit 1
|
|
fi
|
|
|
|
names=$(python3 "$(dirname "$0")/release-contract.py" names "$out_dir")
|
|
while IFS= read -r name; do
|
|
package_curl -f -o "$out_dir/$name" "$package_root/$name"
|
|
done <<< "$names"
|
|
python3 "$(dirname "$0")/release-contract.py" receipt "$out_dir" >/dev/null
|
|
|
|
echo "Verified package candidate $package_version receipt $actual_receipt"
|