LBRYCommunity/lbrycrd
1
0
Fork 0
Code Issues 29 Pull requests 1 Projects Releases 32 Packages Wiki Activity

Make verify-commits POSIX-compliant

Browse source
This commit is contained in:
Matt Corallo 2016-05-20 18:29:15 -07:00 • committed by Peter Todd
parent 7771aa57bd
commit f7d4a25fe6
2 changed files with 11 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
contrib/verify-commits/gpg.sh
View file

@ -1,8 +1,9 @@
#!/bin/sh #!/bin/sh
INPUT=$(</dev/stdin) INPUT=$(cat /dev/stdin)
VALID=false VALID=false
REVSIG=false REVSIG=false
IFS=$'\n' IFS='
'
for LINE in $(echo "$INPUT" | gpg --trust-model always "$@" 2>/dev/null); do for LINE in $(echo "$INPUT" | gpg --trust-model always "$@" 2>/dev/null); do
case "$LINE" in case "$LINE" in
"[GNUPG:] VALIDSIG "*) "[GNUPG:] VALIDSIG "*)
@ -13,10 +14,9 @@ for LINE in $(echo "$INPUT" | gpg --trust-model always "$@" 2>/dev/null); do
"[GNUPG:] REVKEYSIG "*) "[GNUPG:] REVKEYSIG "*)
[ "$BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG" != 1 ] && exit 1 [ "$BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG" != 1 ] && exit 1
while read KEY; do while read KEY; do
case "$LINE" in "[GNUPG:] REVKEYSIG ${KEY:24:40} "*) case "$LINE" in "[GNUPG:] REVKEYSIG ${KEY#????????????????????????} "*)
REVSIG=true REVSIG=true
GOODREVSIG="[GNUPG:] GOODSIG ${KEY:24:40} " GOODREVSIG="[GNUPG:] GOODSIG ${KEY#????????????????????????} "
;;
esac esac
done < ./contrib/verify-commits/trusted-keys done < ./contrib/verify-commits/trusted-keys
;; ;;

15
contrib/verify-commits/verify-commits.sh
View file

@ -1,4 +1,6 @@
#!/bin/sh #!/bin/sh
# Not technically POSIX-compliant due to use of "local", but almost every
# shell anyone uses today supports it, so its probably fine
DIR=$(dirname "$0") DIR=$(dirname "$0")
@ -6,20 +8,14 @@ echo "Please verify all commits in the following list are not evil:"
git log "$DIR" git log "$DIR"
VERIFIED_ROOT=$(cat "${DIR}/trusted-git-root") VERIFIED_ROOT=$(cat "${DIR}/trusted-git-root")
REVSIG_ALLOWED=$(cat "${DIR}/allow-revsig-commits")
IS_REVSIG_ALLOWED () {
while read LINE; do
[ "$LINE" = "$1" ] && return 0
done < "${DIR}/allow-revsig-commits"
return 1
}
HAVE_FAILED=false HAVE_FAILED=false
IS_SIGNED () { IS_SIGNED () {
if [ $1 = $VERIFIED_ROOT ]; then if [ $1 = $VERIFIED_ROOT ]; then
return 0; return 0;
fi fi
if IS_REVSIG_ALLOWED "$1"; then if [ "${REVSIG_ALLOWED#*$1}" != "$REVSIG_ALLOWED" ]; then
export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=1 export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=1
else else
export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=0 export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=0
@ -27,7 +23,8 @@ IS_SIGNED () {
if ! git -c "gpg.program=${DIR}/gpg.sh" verify-commit $1 > /dev/null 2>&1; then if ! git -c "gpg.program=${DIR}/gpg.sh" verify-commit $1 > /dev/null 2>&1; then
return 1; return 1;
fi fi
local PARENTS=$(git show -s --format=format:%P $1) local PARENTS
PARENTS=$(git show -s --format=format:%P $1)
for PARENT in $PARENTS; do for PARENT in $PARENTS; do
if IS_SIGNED $PARENT > /dev/null; then if IS_SIGNED $PARENT > /dev/null; then
return 0; return 0;