Files
dosh/scripts/verify-release-artifacts.sh
DuProcess be98fb8d91
ci / test (push) Waiting to run
ci / fuzz-smoke (push) Waiting to run
ci / windows-client (push) Waiting to run
ci / package-release (linux-x86_64, ubuntu-latest) (push) Waiting to run
ci / package-release (macos-aarch64, macos-14) (push) Waiting to run
ci / package-release (macos-x86_64, macos-13) (push) Waiting to run
ci / package-release (windows-x86_64, windows-latest) (push) Waiting to run
ci / publish-gitea-release (push) Blocked by required conditions
ci / remote-bench (push) Waiting to run
Harden release artifact verification
2026-07-13 01:03:16 -04:00

123 lines
2.6 KiB
Bash

#!/usr/bin/env sh
set -eu
repo_root="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
cd "$repo_root"
version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | sed -n '1p')"
out_dir="${DOSH_PACKAGE_DIR:-target/dosh-release}"
artifact_version() {
artifact="$1"
case "$artifact" in
*.tar.gz)
tar -xOf "$artifact" dosh/VERSION 2>/dev/null | tr -d '\r\n'
;;
*.zip)
unzip -p "$artifact" dosh/VERSION 2>/dev/null | tr -d '\r\n'
;;
*)
return 1
;;
esac
}
archive_contains() {
artifact="$1"
member="$2"
case "$artifact" in
*.tar.gz)
tar -tzf "$artifact" "$member" >/dev/null 2>&1
;;
*.zip)
unzip -Z1 "$artifact" 2>/dev/null | grep -Fx "$member" >/dev/null 2>&1
;;
*)
return 1
;;
esac
}
expected_members() {
artifact_name="$(basename -- "$1")"
case "$artifact_name" in
dosh-windows-*.zip)
cat <<EOF
dosh/VERSION
dosh/bin/dosh.exe
dosh/bin/dosh-client.exe
dosh/bin/dosh-bench.exe
EOF
;;
dosh-*.tar.gz)
cat <<EOF
dosh/VERSION
dosh/bin/dosh
dosh/bin/dosh-client
dosh/bin/dosh-server
dosh/bin/dosh-auth
dosh/bin/dosh-bench
EOF
;;
*)
cat <<EOF
dosh/VERSION
EOF
;;
esac
}
checksum_value() {
artifact="$1"
if command -v sha256sum >/dev/null 2>&1; then
sha256sum "$artifact" | awk '{print $1}'
elif command -v shasum >/dev/null 2>&1; then
shasum -a 256 "$artifact" | awk '{print $1}'
else
return 1
fi
}
verify_checksum() {
artifact="$1"
checksum="$artifact.sha256"
expected="$(awk '{print $1; exit}' "$checksum")"
actual="$(checksum_value "$artifact" || true)"
[ -n "$actual" ] && [ "$actual" = "$expected" ]
}
if [ "$#" -gt 0 ]; then
artifacts="$*"
else
artifacts="$out_dir/dosh-linux-x86_64.tar.gz $out_dir/dosh-macos-aarch64.tar.gz $out_dir/dosh-macos-x86_64.tar.gz $out_dir/dosh-windows-x86_64.zip"
fi
failed=0
for artifact in $artifacts; do
if [ ! -f "$artifact" ]; then
echo "missing release artifact: $artifact" >&2
failed=1
continue
fi
if [ ! -f "$artifact.sha256" ]; then
echo "missing release checksum: $artifact.sha256" >&2
failed=1
elif ! verify_checksum "$artifact"; then
echo "release checksum mismatch: $artifact" >&2
failed=1
fi
actual="$(artifact_version "$artifact" || true)"
if [ "$actual" != "$version" ]; then
echo "artifact version mismatch: $artifact has ${actual:-unknown}, expected $version" >&2
failed=1
fi
for member in $(expected_members "$artifact"); do
if ! archive_contains "$artifact" "$member"; then
echo "artifact missing expected member: $artifact:$member" >&2
failed=1
fi
done
done
exit "$failed"