Martchus
/
devtools
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

archrelease: ensure we check the checksum of the package 

Signed-off-by: Morten Linderud <foxboron@archlinux.org>
This commit is contained in:
Morten Linderud 2020-05-30 01:59:58 +02:00 committed by Levente Polyak
parent b6f5220bed
commit f7d122044b
No known key found for this signature in database
GPG Key ID: FC1B547C8D8172C8
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/archrelease.in
View File

@ -42,6 +42,17 @@ if git rev-parse "$pkgver" >/dev/null 2>&1; then
die "archrelease: the tag $pkgver already exists in the repository!"
fi
# If the tag exists we check if it's properly signed and that it
# matches the working directory PKGBUILD.
if git tag --verify "$pkgver" &> /dev/null; then
cwd_checksum=$(sha256sum PKGBUILD|cut -d' ' -f1)
tag_checksum=$(git show $pkgver:PKGBUILD | sha256sum |cut -d' ' -f1)
if [[ "$cwd_checksum" != "$tag_checksum" ]]; then
die "tagged PKGBUILD is not the same as the working dir PKGBUILD"
fi
exit 0
fi
stat_busy "Releasing package"
printf -v tag_list ", %s" "$@"; tag_list="${tag_list#, }"
git tag -s -m "archrelease: released $pkgbase-$pkgver to $tag_list" "$pkgver" || abort