diff options
Diffstat (limited to 'website/install.sh')
| -rwxr-xr-x | website/install.sh | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/website/install.sh b/website/install.sh index 81c583ac..4e3ce40d 100755 --- a/website/install.sh +++ b/website/install.sh @@ -50,11 +50,38 @@ main() { exit } ')" + SHA256="$(printf '%s\n' "$MANIFEST" | awk -v target="\"${TARGET}\"" ' + /^[[:space:]]*"sha256"[[:space:]]*:/ { in_sha256 = 1; next } + in_sha256 && /^[[:space:]]*}/ { exit } + in_sha256 && index($0, target) { + sub(/^.*:[[:space:]]*"/, "") + sub(/".*$/, "") + print + exit + } + ')" VERSION="$(printf '%s\n' "$MANIFEST" | awk -F '"' '/^[[:space:]]*"version"[[:space:]]*:/ { print $4; exit }')" if [ -z "$URL" ]; then err "release manifest does not include a binary for ${TARGET}" fi + if [ "${#SHA256}" -ne 64 ]; then + err "release manifest does not include a valid SHA-256 checksum for ${TARGET}" + fi + if ! printf '%s\n' "$SHA256" | awk '/[^0-9A-Fa-f]/ { exit 1 }'; then + err "release manifest does not include a valid SHA-256 checksum for ${TARGET}" + fi + SHA256="$(printf '%s\n' "$SHA256" | awk '{ print tolower($0) }')" + + if command -v sha256sum >/dev/null 2>&1; then + SHA256_TOOL="sha256sum" + elif command -v shasum >/dev/null 2>&1; then + SHA256_TOOL="shasum" + elif command -v openssl >/dev/null 2>&1; then + SHA256_TOOL="openssl" + else + err "SHA-256 verification requires sha256sum, shasum, or openssl" + fi if [ -n "$VERSION" ]; then log "downloading v${VERSION}..." @@ -68,6 +95,15 @@ main() { err "download failed from ${URL}" fi + case "$SHA256_TOOL" in + sha256sum) ACTUAL_SHA256="$(sha256sum < "${TMP}/${BIN}" | awk '{ print $1 }')" ;; + shasum) ACTUAL_SHA256="$(shasum -a 256 < "${TMP}/${BIN}" | awk '{ print $1 }')" ;; + openssl) ACTUAL_SHA256="$(openssl dgst -sha256 < "${TMP}/${BIN}" | awk '{ print $NF }')" ;; + esac + if [ "$ACTUAL_SHA256" != "$SHA256" ]; then + err "downloaded Herdr checksum did not match" + fi + # install mkdir -p "$INSTALL_DIR" mv "${TMP}/${BIN}" "${INSTALL_DIR}/${BIN}" |