|
| 1 | +#!/bin/bash |
| 2 | + |
| 3 | +MANIFEST_URL="https://getalby.com/install/hub/manifest.txt" |
| 4 | +SIGNATURE_URL="https://getalby.com/install/hub/manifest.txt.asc" |
| 5 | + |
| 6 | +verify_package() { |
| 7 | + local archive_file="${1}" |
| 8 | + local filename_in_manifest="${2}" |
| 9 | + local response="" |
| 10 | + |
| 11 | + while true; do |
| 12 | + read -r -p "Verify package signature and integrity? (Y/N): " response |
| 13 | + case "$response" in |
| 14 | + [Yy]) break ;; |
| 15 | + [Nn]) echo "Verification skipped." ; return 0 ;; |
| 16 | + *) echo "Invalid input. Please enter Y or N." ;; |
| 17 | + esac |
| 18 | + done |
| 19 | + |
| 20 | + for cmd in gpg sha256sum; do |
| 21 | + if ! command -v "$cmd" &>/dev/null; then |
| 22 | + echo "❌ Required command '$cmd' is not available." >&2 |
| 23 | + return 1 |
| 24 | + fi |
| 25 | + done |
| 26 | + |
| 27 | + echo "Downloading manifest file..." |
| 28 | + if ! wget -q "$MANIFEST_URL"; then |
| 29 | + echo "❌ Failed to download manifest file." >&2 |
| 30 | + return 1 |
| 31 | + fi |
| 32 | + |
| 33 | + echo "Downloading manifest signature file..." |
| 34 | + if ! wget -q "$SIGNATURE_URL"; then |
| 35 | + echo "❌ Failed to download manifest signature file." >&2 |
| 36 | + return 1 |
| 37 | + fi |
| 38 | + |
| 39 | + if ! gpg --batch --verify "manifest.txt.asc" "manifest.txt"; then |
| 40 | + echo "❌ GPG signature verification failed!" >&2 |
| 41 | + echo "Visit https://github.com/getAlby/hub/releases for more information on how to verify the release" >&2 |
| 42 | + return 1 |
| 43 | + fi |
| 44 | + |
| 45 | + local expected_hash |
| 46 | + expected_hash=$(grep "${filename_in_manifest}" "manifest.txt" | awk '{print $1}') || true |
| 47 | + if [[ -z "$expected_hash" ]]; then |
| 48 | + echo "❌ No hash entry found for ${filename_in_manifest} in the manifest." >&2 |
| 49 | + return 1 |
| 50 | + fi |
| 51 | + |
| 52 | + local actual_hash |
| 53 | + actual_hash=$(sha256sum "$archive_file" | awk '{print $1}') |
| 54 | + |
| 55 | + if [[ "$expected_hash" != "$actual_hash" ]]; then |
| 56 | + echo "❌ SHA256 hash mismatch! The file may be corrupted or tampered with." >&2 |
| 57 | + return 1 |
| 58 | + fi |
| 59 | + |
| 60 | + echo "✅ Verification successful. The package is authentic and intact." |
| 61 | + return 0 |
| 62 | +} |
| 63 | + |
| 64 | +if [[ $# -ne 2 ]]; then |
| 65 | + echo "Usage: $0 <archive_file> <filename_in_manifest>" |
| 66 | + exit 1 |
| 67 | +fi |
| 68 | + |
| 69 | +verify_package "$1" "$2" |
| 70 | +if [[ $? -ne 0 ]]; then |
| 71 | + exit 1 |
| 72 | +fi |
0 commit comments