52 lines
1.5 KiB
Bash
52 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
ARCHIVE=$1
|
|
MANIFEST=$2
|
|
SIGNATURE=${3:-}
|
|
|
|
if [ -z "$SIGNATURE" ]; then
|
|
echo "Signature is required."
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v cosign &> /dev/null; then
|
|
echo "cosign could not be found."
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v jq &> /dev/null; then
|
|
echo "jq could not be found."
|
|
exit 1
|
|
fi
|
|
|
|
# Verify signature
|
|
if [ -n "${SMM_TEST_PUBKEY:-}" ]; then
|
|
cosign verify-blob "$MANIFEST" --signature "$SIGNATURE" --key "$SMM_TEST_PUBKEY" >/dev/null 2>&1
|
|
else
|
|
cosign verify-blob "$MANIFEST" \
|
|
--signature "$SIGNATURE" \
|
|
--certificate-identity-regexp "^https://github.com/ochenstarik-ui/server-monitor-manager/" \
|
|
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" >/dev/null 2>&1
|
|
fi
|
|
|
|
# Parse expected hash from manifest based on archive name (assuming archive name ends with .tar.gz or .msix)
|
|
ARCHIVE_BASENAME=$(basename "$ARCHIVE")
|
|
# The manifest schema isn't fully defined yet, but we expect it to contain hashes.
|
|
# We can store them as { "hashes": { "server-monitor-manager-linux-x64.tar.gz": "sha256..." } }
|
|
EXPECTED_HASH=$(jq -r ".hashes[\"$ARCHIVE_BASENAME\"]" "$MANIFEST")
|
|
|
|
if [ "$EXPECTED_HASH" == "null" ] || [ -z "$EXPECTED_HASH" ]; then
|
|
echo "Hash for $ARCHIVE_BASENAME not found in manifest."
|
|
exit 1
|
|
fi
|
|
|
|
ACTUAL_HASH=$(sha256sum "$ARCHIVE" | awk '{print $1}')
|
|
|
|
if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then
|
|
echo "Hash mismatch for $ARCHIVE_BASENAME! Expected $EXPECTED_HASH, got $ACTUAL_HASH."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Verification successful."
|
|
exit 0
|