mirror of
https://github.com/storytold/photocraft.git
synced 2026-10-25 23:50:01 +00:00
skylar taylor-barrick
2bf49f10a7
* security: pin and verify release build inputs * docs: explain verified offline AppImage inputs * security: validate executable AppImage tooling offline * security: preserve read-only verified AppImage caches * test: cover verified runtime downloads and cache diagnostics * test: assert verified runtime mode and cache diagnostics * Fix shellcheck ordering in verified download test * Use external chmod for cache test setup
40 lines
1.4 KiB
Bash
40 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Source after packaging/env.sh, which supplies sha256(). Keep the verified cache usable when
|
|
# an official asset was pre-seeded by a tool that created it without an execute bit.
|
|
|
|
download_verified() {
|
|
local url="$1" dest="$2" expected="$3" executable="${4:-false}" tmp
|
|
if [ -f "$dest" ] && [ "$(sha256 "$dest")" = "$expected" ]; then
|
|
if [ "$executable" = true ] && [ ! -x "$dest" ] && ! chmod 755 "$dest"; then
|
|
echo "error: verified asset is not executable and cannot be chmod'd: $dest" >&2
|
|
return 1
|
|
fi
|
|
return 0
|
|
fi
|
|
tmp="$(mktemp "$dest.XXXXXX")"
|
|
if ! curl -fsSL -o "$tmp" "$url"; then rm -f "$tmp"; return 1; fi
|
|
if [ "$(sha256 "$tmp")" != "$expected" ]; then
|
|
echo "error: SHA-256 mismatch for $url" >&2
|
|
rm -f "$tmp"
|
|
return 1
|
|
fi
|
|
if [ "$executable" = true ]; then
|
|
if ! chmod 755 "$tmp"; then rm -f "$tmp"; return 1; fi
|
|
else
|
|
if ! chmod 644 "$tmp"; then rm -f "$tmp"; return 1; fi
|
|
fi
|
|
if ! mv -f "$tmp" "$dest"; then rm -f "$tmp"; return 1; fi
|
|
}
|
|
|
|
verify_appimagetool_override() {
|
|
local tool="$1" expected="$2" version="$3" arch="$4"
|
|
if [ ! -f "$tool" ] || [ "$(sha256 "$tool")" != "$expected" ]; then
|
|
echo "error: APPIMAGETOOL must be the verified $version $arch release asset" >&2
|
|
return 1
|
|
fi
|
|
if [ ! -x "$tool" ]; then
|
|
echo "error: APPIMAGETOOL must be executable (chmod +x $tool)" >&2
|
|
return 1
|
|
fi
|
|
}
|