mirror of
https://github.com/dashpay/dash.git
synced 2024-12-30 22:35:51 +01:00
c17f11f7b4
13a81b19d
Add quotes to variable assignment (as requested by @TheBlueMatt) (practicalswift)683b9d280
Fix valid path output (practicalswift)193c2fb4c
Use bash instead of POSIX sh. POSIX sh does not support arrays. (practicalswift)80f5f28d3
Fix incorrect quoting of quotes (the previous quotes had no effect beyond unquoting) (practicalswift)564a172df
Add required space to [[ -n "$1" ]] (previously [[ -n"$1" ]]) (practicalswift)1e44ae0e1
Add error handling: exit if cd fails (practicalswift)b9e79ab41
Remove "\n" from echo argument. echo does not support escape sequences. (practicalswift)f6b3382fa
Remove unused variables (practicalswift) Pull request description: Shell script cleanups: * Add required space to `[ -n ]`. * Avoid quote within quote. * Exit if `cd` fails. * Remove `\n` which is not handled by `echo`. * ~~Remove redundant `$` in arithmetic variable expression.~~ * ~~Use `$(command)` instead of legacy form `` `command` ``.~~ * Arrays are not supported in POSIX `sh`. Use `bash` when arrays are used. * ~~`[ foo -a bar ]` is not well defined, use `[ foo ] && [ bar ]` instead.~~ * ~~`[ foo -o bar ]` is not well defined, use `[ foo ] || [ bar ]` instead.~~ Tree-SHA512: 80f6ded58bce625b15b4da30d69d2714c633e184e62b21ed67d2c58e2ebaa08b4147593324012694d02bf4f1f252844cdff2fd1cf5e817ddb07e2777db7a6390
132 lines
3.4 KiB
Bash
Executable File
132 lines
3.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# Copyright (c) 2014-2016 The Bitcoin Core developers
|
|
# Distributed under the MIT software license, see the accompanying
|
|
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
|
|
|
|
DIR=$(dirname "$0")
|
|
[ "/${DIR#/}" != "$DIR" ] && DIR=$(dirname "$(pwd)/$0")
|
|
|
|
echo "Using verify-commits data from ${DIR}"
|
|
|
|
VERIFIED_ROOT=$(cat "${DIR}/trusted-git-root")
|
|
VERIFIED_SHA512_ROOT=$(cat "${DIR}/trusted-sha512-root-commit")
|
|
REVSIG_ALLOWED=$(cat "${DIR}/allow-revsig-commits")
|
|
|
|
HAVE_GNU_SHA512=1
|
|
[ ! -x "$(which sha512sum)" ] && HAVE_GNU_SHA512=0
|
|
|
|
if [ x"$1" = "x" ]; then
|
|
CURRENT_COMMIT="HEAD"
|
|
else
|
|
CURRENT_COMMIT="$1"
|
|
fi
|
|
|
|
if [ "${CURRENT_COMMIT#* }" != "$CURRENT_COMMIT" ]; then
|
|
echo "Commit must not contain spaces?" > /dev/stderr
|
|
exit 1
|
|
fi
|
|
|
|
VERIFY_TREE=0
|
|
if [ x"$2" = "x--tree-checks" ]; then
|
|
VERIFY_TREE=1
|
|
fi
|
|
|
|
NO_SHA1=1
|
|
PREV_COMMIT=""
|
|
INITIAL_COMMIT="${CURRENT_COMMIT}"
|
|
|
|
while true; do
|
|
if [ "$CURRENT_COMMIT" = $VERIFIED_ROOT ]; then
|
|
echo "There is a valid path from \"$INITIAL_COMMIT\" to $VERIFIED_ROOT where all commits are signed!"
|
|
exit 0
|
|
fi
|
|
|
|
if [ "$CURRENT_COMMIT" = $VERIFIED_SHA512_ROOT ]; then
|
|
if [ "$VERIFY_TREE" = "1" ]; then
|
|
echo "All Tree-SHA512s matched up to $VERIFIED_SHA512_ROOT" > /dev/stderr
|
|
fi
|
|
VERIFY_TREE=0
|
|
NO_SHA1=0
|
|
fi
|
|
|
|
if [ "$NO_SHA1" = "1" ]; then
|
|
export BITCOIN_VERIFY_COMMITS_ALLOW_SHA1=0
|
|
else
|
|
export BITCOIN_VERIFY_COMMITS_ALLOW_SHA1=1
|
|
fi
|
|
|
|
if [ "${REVSIG_ALLOWED#*$CURRENT_COMMIT}" != "$REVSIG_ALLOWED" ]; then
|
|
export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=1
|
|
else
|
|
export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=0
|
|
fi
|
|
|
|
if ! git -c "gpg.program=${DIR}/gpg.sh" verify-commit "$CURRENT_COMMIT" > /dev/null; then
|
|
if [ "$PREV_COMMIT" != "" ]; then
|
|
echo "No parent of $PREV_COMMIT was signed with a trusted key!" > /dev/stderr
|
|
echo "Parents are:" > /dev/stderr
|
|
PARENTS=$(git show -s --format=format:%P $PREV_COMMIT)
|
|
for PARENT in $PARENTS; do
|
|
git show -s $PARENT > /dev/stderr
|
|
done
|
|
else
|
|
echo "$CURRENT_COMMIT was not signed with a trusted key!" > /dev/stderr
|
|
fi
|
|
exit 1
|
|
fi
|
|
|
|
# We always verify the top of the tree
|
|
if [ "$VERIFY_TREE" = 1 -o "$PREV_COMMIT" = "" ]; then
|
|
IFS_CACHE="$IFS"
|
|
IFS='
|
|
'
|
|
for LINE in $(git ls-tree --full-tree -r "$CURRENT_COMMIT"); do
|
|
case "$LINE" in
|
|
"12"*)
|
|
echo "Repo contains symlinks" > /dev/stderr
|
|
IFS="$IFS_CACHE"
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
IFS="$IFS_CACHE"
|
|
|
|
FILE_HASHES=""
|
|
for FILE in $(git ls-tree --full-tree -r --name-only "$CURRENT_COMMIT" | LC_ALL=C sort); do
|
|
if [ "$HAVE_GNU_SHA512" = 1 ]; then
|
|
HASH=$(git cat-file blob "$CURRENT_COMMIT":"$FILE" | sha512sum | { read FIRST _; echo $FIRST; } )
|
|
else
|
|
HASH=$(git cat-file blob "$CURRENT_COMMIT":"$FILE" | shasum -a 512 | { read FIRST _; echo $FIRST; } )
|
|
fi
|
|
[ "$FILE_HASHES" != "" ] && FILE_HASHES="$FILE_HASHES"'
|
|
'
|
|
FILE_HASHES="$FILE_HASHES$HASH $FILE"
|
|
done
|
|
|
|
if [ "$HAVE_GNU_SHA512" = 1 ]; then
|
|
TREE_HASH="$(echo "$FILE_HASHES" | sha512sum)"
|
|
else
|
|
TREE_HASH="$(echo "$FILE_HASHES" | shasum -a 512)"
|
|
fi
|
|
HASH_MATCHES=0
|
|
MSG="$(git show -s --format=format:%B "$CURRENT_COMMIT" | tail -n1)"
|
|
|
|
case "$MSG -" in
|
|
"Tree-SHA512: $TREE_HASH")
|
|
HASH_MATCHES=1;;
|
|
esac
|
|
|
|
if [ "$HASH_MATCHES" = "0" ]; then
|
|
echo "Tree-SHA512 did not match for commit $CURRENT_COMMIT" > /dev/stderr
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
PARENTS=$(git show -s --format=format:%P "$CURRENT_COMMIT")
|
|
for PARENT in $PARENTS; do
|
|
PREV_COMMIT="$CURRENT_COMMIT"
|
|
CURRENT_COMMIT="$PARENT"
|
|
break
|
|
done
|
|
done
|