mirror of
https://github.com/getAlby/hub.git
synced 2026-08-20 13:28:40 +02:00
004884c07f
* feat: archive integrity verification WIP * feat: archive integrity verification in the aarch64 update script * chore: extract verification into a separate file * feat: add signature verification to all installation and update scripts * fix: pass correct filenames when invoking the verification script
72 lines
1.9 KiB
Bash
72 lines
1.9 KiB
Bash
#!/bin/bash
|
|
|
|
MANIFEST_URL="https://getalby.com/install/hub/manifest.txt"
|
|
SIGNATURE_URL="https://getalby.com/install/hub/manifest.txt.asc"
|
|
|
|
verify_package() {
|
|
local archive_file="${1}"
|
|
local filename_in_manifest="${2}"
|
|
local response=""
|
|
|
|
while true; do
|
|
read -r -p "Verify package signature and integrity? (Y/N): " response
|
|
case "$response" in
|
|
[Yy]) break ;;
|
|
[Nn]) echo "Verification skipped." ; return 0 ;;
|
|
*) echo "Invalid input. Please enter Y or N." ;;
|
|
esac
|
|
done
|
|
|
|
for cmd in gpg sha256sum; do
|
|
if ! command -v "$cmd" &>/dev/null; then
|
|
echo "❌ Required command '$cmd' is not available." >&2
|
|
return 1
|
|
fi
|
|
done
|
|
|
|
echo "Downloading manifest file..."
|
|
if ! wget -q "$MANIFEST_URL"; then
|
|
echo "❌ Failed to download manifest file." >&2
|
|
return 1
|
|
fi
|
|
|
|
echo "Downloading manifest signature file..."
|
|
if ! wget -q "$SIGNATURE_URL"; then
|
|
echo "❌ Failed to download manifest signature file." >&2
|
|
return 1
|
|
fi
|
|
|
|
if ! gpg --batch --verify "manifest.txt.asc" "manifest.txt"; then
|
|
echo "❌ GPG signature verification failed!" >&2
|
|
echo "Visit https://github.com/getAlby/hub/releases for more information on how to verify the release" >&2
|
|
return 1
|
|
fi
|
|
|
|
local expected_hash
|
|
expected_hash=$(grep "${filename_in_manifest}" "manifest.txt" | awk '{print $1}') || true
|
|
if [[ -z "$expected_hash" ]]; then
|
|
echo "❌ No hash entry found for ${filename_in_manifest} in the manifest." >&2
|
|
return 1
|
|
fi
|
|
|
|
local actual_hash
|
|
actual_hash=$(sha256sum "$archive_file" | awk '{print $1}')
|
|
|
|
if [[ "$expected_hash" != "$actual_hash" ]]; then
|
|
echo "❌ SHA256 hash mismatch! The file may be corrupted or tampered with." >&2
|
|
return 1
|
|
fi
|
|
|
|
echo "✅ Verification successful. The package is authentic and intact."
|
|
return 0
|
|
}
|
|
|
|
if [[ $# -ne 2 ]]; then
|
|
echo "Usage: $0 <archive_file> <filename_in_manifest>"
|
|
exit 1
|
|
fi
|
|
|
|
verify_package "$1" "$2"
|
|
if [[ $? -ne 0 ]]; then
|
|
exit 1
|
|
fi
|