41 lines
1.3 KiB
Bash
Executable File
41 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch the exact Debian package payload described by the integrity lock.
|
|
|
|
set -Eeuo pipefail
|
|
|
|
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
|
|
PROJECT_DIR=$(cd -- "$SCRIPT_DIR/.." && pwd -P)
|
|
LOCK_FILE=${1:-"$SCRIPT_DIR/debian-packages.lock.tsv"}
|
|
OUTPUT_DIR=${2:-"$PROJECT_DIR/work/apt/archives"}
|
|
|
|
[[ -s "$LOCK_FILE" ]] || { echo "Missing package lock: $LOCK_FILE" >&2; exit 1; }
|
|
mkdir -p "$OUTPUT_DIR"
|
|
|
|
while IFS=$'\t' read -r filename expected_size expected_sha url; do
|
|
[[ "$filename" == '# filename' ]] && continue
|
|
[[ -n "$filename" && "$expected_sha" =~ ^[0-9a-f]{64}$ ]] || {
|
|
echo "Malformed package lock row: $filename" >&2
|
|
exit 1
|
|
}
|
|
output="$OUTPUT_DIR/$filename"
|
|
if [[ -f "$output" ]] &&
|
|
[[ "$(stat -c '%s' "$output")" == "$expected_size" ]] &&
|
|
[[ "$(sha256sum "$output" | awk '{print $1}')" == "$expected_sha" ]]; then
|
|
continue
|
|
fi
|
|
partial="$output.partial"
|
|
rm -f -- "$partial"
|
|
curl --fail --location --show-error --output "$partial" "$url"
|
|
[[ "$(stat -c '%s' "$partial")" == "$expected_size" ]] || {
|
|
echo "Size mismatch for $filename" >&2
|
|
exit 1
|
|
}
|
|
echo "$expected_sha $partial" | sha256sum --check --status || {
|
|
echo "Checksum mismatch for $filename" >&2
|
|
exit 1
|
|
}
|
|
mv -- "$partial" "$output"
|
|
done <"$LOCK_FILE"
|
|
|
|
echo "Verified locked package bundle: $OUTPUT_DIR"
|