66 lines
2.1 KiB
Bash
66 lines
2.1 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# Generate an integrity lock for an already-resolved Debian package bundle.
|
||
|
|
|
||
|
|
set -Eeuo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
|
||
|
|
PROJECT_DIR=$(cd -- "$SCRIPT_DIR/.." && pwd -P)
|
||
|
|
ARCHIVE_DIR=${1:-"$PROJECT_DIR/work/apt/archives"}
|
||
|
|
LIST_DIR=${2:-"$PROJECT_DIR/work/apt/lists"}
|
||
|
|
OUTPUT=${3:-"$SCRIPT_DIR/debian-packages.lock.tsv"}
|
||
|
|
|
||
|
|
[[ -d "$ARCHIVE_DIR" && -d "$LIST_DIR" ]] || {
|
||
|
|
echo "Usage: $0 [ARCHIVE-DIR LIST-DIR OUTPUT]" >&2
|
||
|
|
exit 2
|
||
|
|
}
|
||
|
|
|
||
|
|
INDEX=$(mktemp)
|
||
|
|
OUTPUT_TMP=$(mktemp)
|
||
|
|
trap 'rm -f -- "$INDEX" "$OUTPUT_TMP"' EXIT
|
||
|
|
|
||
|
|
for package_list in "$LIST_DIR"/*_Packages; do
|
||
|
|
[[ -f "$package_list" ]] || continue
|
||
|
|
case "$(basename -- "$package_list")" in
|
||
|
|
security.debian.org_*) base_url=https://security.debian.org/debian-security ;;
|
||
|
|
deb.debian.org_*) base_url=https://deb.debian.org/debian ;;
|
||
|
|
*) continue ;;
|
||
|
|
esac
|
||
|
|
awk -v base_url="$base_url" '
|
||
|
|
/^Filename: / { filename=substr($0, 11) }
|
||
|
|
/^Size: / { size=substr($0, 7) }
|
||
|
|
/^SHA256: / { sha=substr($0, 9) }
|
||
|
|
/^$/ {
|
||
|
|
if (filename != "" && size != "" && sha != "") {
|
||
|
|
print sha "\t" size "\t" base_url "/" filename
|
||
|
|
}
|
||
|
|
filename=size=sha=""
|
||
|
|
}
|
||
|
|
END {
|
||
|
|
if (filename != "" && size != "" && sha != "") {
|
||
|
|
print sha "\t" size "\t" base_url "/" filename
|
||
|
|
}
|
||
|
|
}
|
||
|
|
' "$package_list" >>"$INDEX"
|
||
|
|
done
|
||
|
|
LC_ALL=C sort -u -o "$INDEX" "$INDEX"
|
||
|
|
|
||
|
|
printf '# filename\tsize\tsha256\turl\n' >"$OUTPUT_TMP"
|
||
|
|
while IFS= read -r -d '' package_path; do
|
||
|
|
filename=$(basename -- "$package_path")
|
||
|
|
size=$(stat -c '%s' "$package_path")
|
||
|
|
sha=$(sha256sum "$package_path" | awk '{print $1}')
|
||
|
|
match=$(awk -F '\t' -v sha="$sha" -v size="$size" \
|
||
|
|
'$1 == sha && $2 == size { print; exit }' "$INDEX")
|
||
|
|
[[ -n "$match" ]] || {
|
||
|
|
echo "No signed package-index record for $filename" >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
url=${match#*$'\t'}
|
||
|
|
url=${url#*$'\t'}
|
||
|
|
printf '%s\t%s\t%s\t%s\n' "$filename" "$size" "$sha" "$url" \
|
||
|
|
>>"$OUTPUT_TMP"
|
||
|
|
done < <(find "$ARCHIVE_DIR" -maxdepth 1 -type f -name '*.deb' -print0 | sort -z)
|
||
|
|
|
||
|
|
install -m 0644 "$OUTPUT_TMP" "$OUTPUT"
|
||
|
|
echo "Locked $(($(wc -l <"$OUTPUT") - 1)) Debian packages in $OUTPUT"
|