mirror of
https://github.com/curl/curl.git
synced 2026-06-18 17:35:43 +03:00
7f57aeec40
- Clarify that the tarball to verify should be put in the same dir you run the script. - Verify that the curl version number in the file name matches the version number within the tarball. To reduce risk for mistakes. - When verifying using git, do not unpack the tarball. It avoids the security risk with malicious tarball contents playing tricks on git. - Only unpack the tarball for git-less verfication. - Move the source tarball into _tarballs/ instead of overwriting it, which can be useful in case the verification fails Closes #22032
121 lines
3.6 KiB
Bash
Executable file
121 lines
3.6 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
#***************************************************************************
|
|
# _ _ ____ _
|
|
# Project ___| | | | _ \| |
|
|
# / __| | | | |_) | |
|
|
# | (__| |_| | _ <| |___
|
|
# \___|\___/|_| \_\_____|
|
|
#
|
|
# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
#
|
|
# This software is licensed as described in the file COPYING, which
|
|
# you should have received as part of this distribution. The terms
|
|
# are also available at https://curl.se/docs/copyright.html.
|
|
#
|
|
# You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
# copies of the Software, and permit persons to whom the Software is
|
|
# furnished to do so, under the terms of the COPYING file.
|
|
#
|
|
# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
# KIND, either express or implied.
|
|
#
|
|
# SPDX-License-Identifier: curl
|
|
#
|
|
###########################################################################
|
|
|
|
# This script remakes a provided curl release and verifies that the newly
|
|
# built version is identical to the original file.
|
|
#
|
|
# Invoke in a clean directory with the release tarball file (stored in the
|
|
# same directory) as an argument for basic verification.
|
|
#
|
|
# For full verification: run the script in an up-to-date curl git repository.
|
|
#
|
|
|
|
set -eu
|
|
|
|
tarball="${1:-}"
|
|
|
|
if [ -z "$tarball" ]; then
|
|
echo "Provide a curl release tarball name as argument"
|
|
exit
|
|
fi
|
|
|
|
i="$(find . -maxdepth 1 -type d -name 'curl-*' | wc -l)"
|
|
|
|
if test "$i" -gt 1; then
|
|
echo "multiple curl-* entries found, disambiguate please"
|
|
exit
|
|
fi
|
|
|
|
# check if this is in a git clone directory
|
|
|
|
if git log -1 include/curl/curl.h 2>/dev/null >/dev/null; then
|
|
echo "*** Detected a git checkout, do full verification"
|
|
withgit=1
|
|
else
|
|
echo "*** Lacking a full git checkout, do the lesser verification"
|
|
withgit=0
|
|
fi
|
|
|
|
mkdir -p _tarballs
|
|
rm -rf _tarballs/*
|
|
|
|
# checksum the original tarball to compare with later
|
|
sha256sum "$tarball" >_tarballs/checksum
|
|
|
|
# extract version number from file name
|
|
tarver=$(echo "$tarball" | sed 's/curl-\([0-9.]*\)\..*/\1/')
|
|
|
|
# extract the version from the official header file
|
|
curlver=$(tar xOf "$tarball" "curl-$tarver/include/curl/curlver.h" | grep '#define LIBCURL_VERSION ' | sed 's/[^0-9.]//g')
|
|
|
|
if test "$tarver" != "$curlver"; then
|
|
echo "Tarball file version ($tarver) mismatches contents of tarball ($curlver)"
|
|
exit 1
|
|
fi
|
|
|
|
timestamp=$(tar xOf "$tarball" "curl-$tarver/docs/RELEASE-TOOLS.md" | grep 'SOURCE_DATE_EPOCH=' | sed 's/[^0-9.]//g')
|
|
|
|
if test "$withgit" = 0; then
|
|
# without git
|
|
|
|
# extract the release contents
|
|
tar xf "$tarball"
|
|
|
|
# move away the original tarball
|
|
mv "$tarball" "_tarballs/orig-$tarball"
|
|
|
|
pwd=$(pwd)
|
|
cd "curl-$curlver"
|
|
./configure --without-ssl --without-libpsl
|
|
./scripts/dmaketgz "$curlver" "$timestamp"
|
|
|
|
for f in "curl-$curlver.tar.gz" "curl-$curlver.tar.bz2" "curl-$curlver.tar.xz" "curl-$curlver.zip"; do
|
|
mv "$f" ../_tarballs/
|
|
done
|
|
cd "$pwd"
|
|
else
|
|
tag=$(tar xOf "$tarball" "curl-$tarver/docs/RELEASE-TOOLS.md" | grep 'tag/commit: curl-' | head -n 1 | sed 's/.*\(curl-[0-9_]*\).*/\1/')
|
|
echo "*** Use git tag $tag"
|
|
|
|
# move away the original tarball
|
|
mv "$tarball" "_tarballs/orig-$tarball"
|
|
|
|
prevtag=$(git symbolic-ref -q --short HEAD || git rev-parse HEAD)
|
|
git checkout -f "$tag"
|
|
|
|
./scripts/dmaketgz "$curlver" "$timestamp"
|
|
|
|
# switch back to where it was
|
|
git checkout -f "$prevtag"
|
|
|
|
for f in "curl-$curlver.tar.gz" "curl-$curlver.tar.bz2" "curl-$curlver.tar.xz" "curl-$curlver.zip"; do
|
|
mv "$f" _tarballs/
|
|
done
|
|
fi
|
|
cd "_tarballs"
|
|
|
|
# compare the new tarball against the original
|
|
sha256sum -c checksum
|