Martchus
/
devtools
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

commitpkg: disallow if PKGBUILD hash mismatches package's enclosed hash 

Several cases showed that we release packages that were built with
different PKGBUILDs than the one commited to the source tree. This is
bad for obvious reasons plus sploils reproducible builds.

We, under no circumstances, want to allow using commitpkg to publish and
release a packages whose PKGBUILD doesn't match the one to be commited.

Signed-off-by: Levente Polyak <anthraxx@archlinux.org>
This commit is contained in:
Levente Polyak 2019-09-13 21:17:20 +02:00
parent a3868cf542
commit fd6e801cfb
No known key found for this signature in database
GPG Key ID: FC1B547C8D8172C8
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
commitpkg.in
View File

@ -83,7 +83,7 @@ while getopts ':l:a:s:f' flag; do
done
shift $(( OPTIND - 1 ))
# check packages have the packager field set
# check packages for validity
for _arch in "${arch[@]}"; do
if [[ -n $commit_arch && ${_arch} != "$commit_arch" ]]; then
continue
@ -95,6 +95,11 @@ for _arch in "${arch[@]}"; do
if grep -q "packager = Unknown Packager" <(bsdtar -xOqf "$pkgfile" .PKGINFO); then
die "PACKAGER was not set when building package"
fi
hashsum=sha256sum
pkgbuild_hash=$(awk -v"hashsum=$hashsum" -F' = ' '$1 == "pkgbuild_"hashsum {print $2}' <(bsdtar -xOqf "$pkgfile" .BUILDINFO))
if [[ "$pkgbuild_hash" != "$($hashsum PKGBUILD|cut -d' ' -f1)" ]]; then
die "PKGBUILD $hashsum mismatch: expected $pkgbuild_hash"
fi
fi
done
done