base: add actual sha256sum checking.

lnls-get-n-unpack now uses all variables defined in .env file as
arguments:
  - shacheck function checks the hashes.
  - Download function now iterates through pairs of arguments to get url
    and hash for each module.
  - Help function describes this usage and can now exit with error code
    as argument.

install_epics, install_opcua, install_area_detector, install_modules and
install_motor:
  - pass variables defined in .env as arguments to lnls-get-n-unpack and
    install_from_github.

install_functions:
    - Add sha as argument to install_from_github and
      download_from_github. install_from_github passes sha as argument
      to download_from_github.

Author: marcofilho

base/install-functions.sh

@@ -10,8 +10,9 @@ download_from_github() {
     github_org=$1
     module_name=$2
     commit=$3
+    sha=$4
 
-    lnls-get-n-unpack -l https://github.com/$github_org/$module_name/archive/$commit.tar.gz
+    lnls-get-n-unpack -l https://github.com/$github_org/$module_name/archive/$commit.tar.gz $sha
 
     mv $module_name-$commit $module_name
 }
@@ -59,7 +60,8 @@ install_from_github() {
     dependency_name=$3
     tag=$4
     release_content="$5"
+    sha=$6
 
-    download_from_github $github_org $module_name $tag
+    download_from_github $github_org $module_name $tag $sha
     install_module $flag_ioc $module_name $dependency_name "$release_content"
 }

base/install_area_detector.sh

@@ -103,7 +103,7 @@ make clean
 
 cd ..
 
-download_from_github cnpem ssc-pimega $LIBSSCPIMEGA_VERSION
+download_from_github cnpem ssc-pimega $LIBSSCPIMEGA_VERSION $LIBSSCPIMEGA_SHA256
 make -C ssc-pimega/c install
 rm -rf ssc-pimega
 
@@ -112,4 +112,5 @@ EPICS_BASE
 ASYN
 AREA_DETECTOR
 ADCORE
-"
+" \
+$NDSSCPIMEGA_SHA256

base/install_epics.sh

@@ -4,7 +4,7 @@ set -ex
 
 . /opt/epics/install-functions.sh
 
-lnls-get-n-unpack -l https://epics-controls.org/download/base/base-${EPICS_BASE_VERSION}.tar.gz
+lnls-get-n-unpack -l https://epics-controls.org/download/base/base-${EPICS_BASE_VERSION}.tar.gz $EPICS_BASE_SHA256
 mv base-${EPICS_BASE_VERSION} ${EPICS_BASE_PATH}
 
 patch -d ${EPICS_BASE_PATH} -Np1 < backport-epics-base-musl.patch

base/install_modules.sh

@@ -6,91 +6,105 @@ set -ex
 
 install_from_github mdavidsaver pvxs PVXS $PVXS_VERSION "
 EPICS_BASE
-"
+" \
+$PVXS_SHA256
 
 install_from_github epics-modules sequencer SNCSEQ $SEQUENCER_VERSION "
 EPICS_BASE
-"
+" \
+$SEQUENCER_SHA256
 
 install_from_github epics-modules calc CALC $CALC_VERSION "
 EPICS_BASE
-"
+" \
+$CALC_SHA256
 
 # Build asyn without seq since it's only needed for testIPServer
 install_from_github epics-modules asyn ASYN $ASYN_VERSION "
 EPICS_BASE
 CALC
-"
+" \
+$ASYN_SHA256
 
 install_from_github epics-modules modbus MODBUS $MODBUS_VERSION "
 EPICS_BASE
 ASYN
-"
+" \
+$MODBUS_SHA256
 
 install_from_github paulscherrerinstitute StreamDevice STREAM $STREAMDEVICE_VERSION "
 EPICS_BASE
 ASYN
 CALC
-"
+" \
+$STREAMDEVICE_SHA256
 
 install_from_github epics-modules busy BUSY $BUSY_VERSION "
 EPICS_BASE
 ASYN
-"
+" \
+$BUSY_SHA256
 
 install_from_github epics-modules autosave AUTOSAVE $AUTOSAVE_VERSION "
 EPICS_BASE
-"
+" \
+$AUTOSAVE_SHA256
 
 install_from_github epics-modules sscan SSCAN $SSCAN_VERSION "
 EPICS_BASE
 SNCSEQ
-"
+" \
+$SSCAN_SHA256
 
-download_from_github ChannelFinder recsync $RECCASTER_VERSION
+download_from_github ChannelFinder recsync $RECCASTER_VERSION $RECCASTER_SHA256
 install_module recsync/client RECCASTER "
 EPICS_BASE
 "
 
 install_from_github epics-modules ipac IPAC $IPAC_VERSION "
 EPICS_BASE
-"
+" \
+$IPAC_SHA256
 
-download_from_github epics-modules caPutLog $CAPUTLOG_VERSION
+download_from_github epics-modules caPutLog $CAPUTLOG_VERSION $CAPUTLOG_SHA256
 patch -d caPutLog -Np1 < caputlog-waveform-fix.patch
 install_module caPutLog CAPUTLOG "
 EPICS_BASE
 "
 
 install_from_github brunoseivam retools RETOOLS $RETOOLS_VERSION "
 EPICS_BASE
-"
+" \
+$RETOOLS_SHA256
 
 install_from_github -i epics-modules ether_ip ETHER_IP $ETHER_IP_VERSION "
 EPICS_BASE
-"
+" \
+$ETHER_IP_SHA256
 
 install_from_github  epics-modules iocStats DEVIOCSTATS $IOCSTATS_VERSION "
 EPICS_BASE
-"
+" \
+$IOCSTATS_SHA256
 
-download_from_github slac-epics-modules ipmiComm $IPMICOMM_VERSION
+download_from_github slac-epics-modules ipmiComm $IPMICOMM_VERSION $IPMICOMM_SHA256
 patch -d ipmiComm -Np1 < backport-ipmicomm.patch
 patch -d ipmiComm -Np1 < ipmicomm.patch
 JOBS=1 install_module ipmiComm IPMICOMM "
 EPICS_BASE
 ASYN
 "
 
-download_from_github mdavidsaver pyDevSup $PYDEVSUP_VERSION
+download_from_github mdavidsaver pyDevSup $PYDEVSUP_VERSION $PYDEVSUP_SHA256
 echo PYTHON=python3 >> pyDevSup/configure/CONFIG_SITE
 install_module pyDevSup PYDEVSUP "
 EPICS_BASE
 "
 
 mkdir snmp
 cd snmp
-lnls-get-n-unpack -l https://groups.nscl.msu.edu/controls/files/epics-snmp-$SNMP_VERSION.zip
+lnls-get-n-unpack -l https://groups.nscl.msu.edu/controls/files/epics-snmp-$SNMP_VERSION.zip \
+$SNMP_SHA256
 cd ..
 install_module -i snmp SNMP "
 EPICS_BASE
@@ -99,7 +113,8 @@ EPICS_BASE
 install_from_github epics-modules scaler SCALER $SCALER_VERSION "
 EPICS_BASE
 ASYN
-"
+" \
+$SCALER_SHA256
 
 install_from_github -i epics-modules mca MCA $MCA_VERSION "
 EPICS_BASE
@@ -111,4 +126,5 @@ SNCSEQ
 AUTOSAVE
 ASYN
 MCA
-"
+" \
+$MCA_SHA256

base/install_motor.sh

@@ -54,7 +54,7 @@ SNCSEQ
 
 cd $EPICS_MODULES_PATH
 
-download_from_github dls-controls pmac $PMAC_VERSION
+download_from_github dls-controls pmac $PMAC_VERSION $PMAC_SHA256
 
 rm pmac/configure/RELEASE.local.linux-x86_64
 rm pmac/configure/RELEASE.linux-x86_64.Common

base/install_opcua.sh

@@ -6,7 +6,7 @@ set -ex
 
 opcua_release_url=https://github.com/epics-modules/opcua/releases/download/v${OPCUA_VERSION}
 opcua_release_file=IOC_opcua-${OPCUA_VERSION}_Base-${EPICS_BASE_VERSION}_debian${DEBIAN_VERSION%.*}.tar.gz
-lnls-get-n-unpack -l $opcua_release_url/$opcua_release_file
+lnls-get-n-unpack -l $opcua_release_url/$opcua_release_file $OPCUA_SHA256
 
 mv binaryOpcuaIoc opcua
 install_module -i opcua OPCUA "

base/lnls-get-n-unpack.sh

@@ -6,13 +6,15 @@ set -eu
 
 help () {
     echo    "lnls-get-n-unpack: download and extract archive from the network"
-    echo -e "Usage: lnls-get-n-unpack <extraction_mode> <URL1> [URL2] [...] [URLN]\n"
+    echo -e "Usage: lnls-get-n-unpack <extraction_mode> <URL1> <1SHA256SUM> [URL2] [2SHA256SUM] [...] [URLN] [NSHA256SUM]\n"
     echo    "Extraction mode:"
     echo    "  -l extracts to local directory (./)"
     echo    "  -r extracts to root directory (/)"
     echo    "URL:"
     echo    "  url to download source from."
-    exit 0
+    echo    "SHA256SUM:"
+    echo    "  Reference sha256 hash to compare url download with."
+    exit $1
 }
 
 check_arguments() {
@@ -25,10 +27,11 @@ check_arguments() {
     # if -h is anywhere arguments list, call help and exit.
     for arg in "$@"; do
         if [ "$arg" == "-h" ] || [ "$arg" == "--help" ]; then
-            help
+            help 0
         fi
     done
 
+    # Check extraction mode
     case "$1" in
         -r) dest=/ ;;
         -l) dest=. ;;
@@ -37,19 +40,48 @@ check_arguments() {
         ;;
     esac
 
+    # Check if we have odd number of arguments (extraction_mode + N*url + N*sha256sum)
+    if [ $(( $# % 2 )) -ne 1 ]; then
+        >&2 echo "ERROR: Even number of arguments detected. Something is wrong."
+        help 1
+    fi
+
+}
+
+shacheck() {
+
+    download_dir=$1
+    sha=$2
+    url=$3
+
+    downloaded_file=$(find $download_dir -type f)
+    if [[ $(echo $downloaded_file | wc -w) -ne 1 ]]; then
+        echo "ERROR: Download of $url is yielding something different than one single file."
+        echo "Don't know how to proceed. Exiting..."
+        exit 1
+    fi
+
+    if ! echo $sha $downloaded_file | sha256sum -c; then
+        echo "ERROR: SHA $sha for URL $url does not match."
+        exit 1
+    fi
+
 }
 
 download () {
 
     shift # Throw extraction mode argument away
 
-    for url; do
+    while [[ $# -gt 1 ]]; do
+        url=$1
+        sha=$2
         download_dir=$(mktemp -d)
 
         echo Downloading "$url"...
         wget -P $download_dir "$url" &> /tmp/wget.log || (cat /tmp/wget.log && false)
 
         filename=$(basename $download_dir/*)
+        shacheck $download_dir $sha $url
 
         if [[ ${filename,,} == *".zip" ]]; then
             unzip -qo $download_dir/$filename -d $dest
@@ -58,6 +90,8 @@ download () {
         fi
 
         rm -rf $download_dir /tmp/wget.log
+
+        shift 2
     done
 
 }