Inside Bitcoin

1#!/usr/bin/env bash
2# Copyright (c) The Bitcoin Core developers
3# Distributed under the MIT software license, see the accompanying
4# file COPYING or https://opensource.org/license/mit.
5export LC_ALL=C.UTF-8
6set -o errexit -o pipefail
7
8# Source the common prelude, which:
9#   1. Checks if we're at the top directory of the Bitcoin Core repository
10#   2. Defines a few common functions and variables
11#
12# shellcheck source=libexec/prelude.bash
13source "$(dirname "${BASH_SOURCE[0]}")/libexec/prelude.bash"
14
15
16###################
17## Sanity Checks ##
18###################
19
20################
21# Required non-builtin commands should be invokable
22################
23
24check_tools cat env basename mkdir diff sort
25
26if [ -z "$NO_SIGN" ]; then
27    # make it possible to override the gpg binary
28    GPG=${GPG:-gpg}
29
30    # $GPG can contain extra arguments passed to the binary
31    # so let's check only the existence of arg[0]
32    # shellcheck disable=SC2206
33    GPG_ARRAY=($GPG)
34    check_tools "${GPG_ARRAY[0]}"
35fi
36
37################
38# Required env vars should be non-empty
39################
40
41cmd_usage() {
42cat <<EOF
43Synopsis:
44
45    env GUIX_SIGS_REPO=<path/to/guix.sigs> \\
46        SIGNER=GPG_KEY_NAME[=SIGNER_NAME] \\
47        [ NO_SIGN=1 ]
48      ./contrib/guix/guix-attest
49
50Example w/o overriding signing name:
51
52    env GUIX_SIGS_REPO=/home/achow101/guix.sigs \\
53        SIGNER=achow101 \\
54      ./contrib/guix/guix-attest
55
56Example overriding signing name:
57
58    env GUIX_SIGS_REPO=/home/dongcarl/guix.sigs \\
59        SIGNER=0x96AB007F1A7ED999=dongcarl \\
60      ./contrib/guix/guix-attest
61
62Example w/o signing, just creating SHA256SUMS:
63
64    env GUIX_SIGS_REPO=/home/achow101/guix.sigs \\
65        SIGNER=achow101 \\
66        NO_SIGN=1 \\
67      ./contrib/guix/guix-attest
68
69EOF
70}
71
72if [ -z "$GUIX_SIGS_REPO" ] || [ -z "$SIGNER" ]; then
73    cmd_usage
74    exit 1
75fi
76
77################
78# GUIX_SIGS_REPO should exist as a directory
79################
80
81if [ ! -d "$GUIX_SIGS_REPO" ]; then
82cat << EOF
83ERR: The specified GUIX_SIGS_REPO is not an existent directory:
84
85    '$GUIX_SIGS_REPO'
86
87Hint: Please clone the guix.sigs repository and point to it with the
88      GUIX_SIGS_REPO environment variable.
89
90EOF
91cmd_usage
92exit 1
93fi
94
95################
96# The key specified in SIGNER should be usable
97################
98
99IFS='=' read -r gpg_key_name signer_name <<< "$SIGNER"
100if [ -z "${signer_name}" ]; then
101    signer_name="$gpg_key_name"
102fi
103
104if [ -z "$NO_SIGN" ] && ! ${GPG} --dry-run --list-secret-keys "${gpg_key_name}" >/dev/null 2>&1; then
105    echo "ERR: GPG can't seem to find any key named '${gpg_key_name}'"
106    exit 1
107fi
108
109################
110# We should be able to find at least one output
111################
112
113echo "Looking for build output SHA256SUMS fragments in ${OUTDIR_BASE}"
114
115shopt -s nullglob
116sha256sum_fragments=( "$OUTDIR_BASE"/*/SHA256SUMS.part ) # This expands to an array of directories...
117shopt -u nullglob
118
119noncodesigned_fragments=()
120codesigned_fragments=()
121
122if (( ${#sha256sum_fragments[@]} )); then
123    echo "Found build output SHA256SUMS fragments:"
124    for outdir in "${sha256sum_fragments[@]}"; do
125        echo "    '$outdir'"
126        case "$outdir" in
127            "$OUTDIR_BASE"/*-codesigned/SHA256SUMS.part)
128                codesigned_fragments+=("$outdir")
129                ;;
130            *)
131                noncodesigned_fragments+=("$outdir")
132                ;;
133        esac
134    done
135    echo
136else
137    echo "ERR: Could not find any build output SHA256SUMS fragments in ${OUTDIR_BASE}"
138    exit 1
139fi
140
141##############
142##  Attest  ##
143##############
144
145shasum_already_exists() {
146cat <<EOF
147--
148
149ERR: An ${1} file already exists for '${VERSION}' and attests
150     differently. You likely previously attested to a partial build (e.g. one
151     where you specified the HOST environment variable).
152
153     See the diff above for more context.
154
155Hint: You may wish to remove the existing attestations and their signatures by
156      invoking:
157
158          rm '${PWD}/${1}'{,.asc}
159
160      Then try running this script again.
161
162EOF
163}
164
165echo "Attesting to build outputs for version: '${VERSION}'"
166echo ""
167
168# Given a SHA256SUMS file as stdin that has lines like:
169#     0ba536819b221a91d3d42e978be016aac918f40984754d74058aa0c921cd3ea6  a/b/d/c/d/s/bitcoin-22.0rc2-riscv64-linux-gnu.tar.gz
170#     ...
171#
172# Replace each line's file name with its basename:
173#     0ba536819b221a91d3d42e978be016aac918f40984754d74058aa0c921cd3ea6  bitcoin-22.0rc2-riscv64-linux-gnu.tar.gz
174#     ...
175#
176basenameify_SHA256SUMS() {
177    sed -E 's@(^[[:xdigit:]]{64}[[:space:]]+).+/([^/]+$)@\1\2@'
178}
179
180outsigdir="$GUIX_SIGS_REPO/$VERSION/$signer_name"
181mkdir -p "$outsigdir"
182(
183    cd "$outsigdir"
184
185    temp_noncodesigned="$(mktemp)"
186    trap 'rm -rf -- "$temp_noncodesigned"' EXIT
187
188    if (( ${#noncodesigned_fragments[@]} )); then
189        cat "${noncodesigned_fragments[@]}" \
190            | sort -u \
191            | sort -k2 \
192            | basenameify_SHA256SUMS \
193                > "$temp_noncodesigned"
194        if [ -e noncodesigned.SHA256SUMS ]; then
195            # The SHA256SUMS already exists, make sure it's exactly what we
196            # expect, error out if not
197            if diff -u noncodesigned.SHA256SUMS "$temp_noncodesigned"; then
198                echo "A noncodesigned.SHA256SUMS file already exists for '${VERSION}' and is up-to-date."
199            else
200                shasum_already_exists noncodesigned.SHA256SUMS
201                exit 1
202            fi
203        else
204            mv "$temp_noncodesigned" noncodesigned.SHA256SUMS
205        fi
206    else
207        echo "ERR: No noncodesigned outputs found for '${VERSION}', exiting..."
208        exit 1
209    fi
210
211    temp_all="$(mktemp)"
212    trap 'rm -rf -- "$temp_all"' EXIT
213
214    if (( ${#codesigned_fragments[@]} )); then
215        # Note: all.SHA256SUMS attests to all of $sha256sum_fragments, but is
216        #       not needed if there are no $codesigned_fragments
217        cat "${sha256sum_fragments[@]}" \
218            | sort -u \
219            | sort -k2 \
220            | basenameify_SHA256SUMS \
221                > "$temp_all"
222        if [ -e all.SHA256SUMS ]; then
223            # The SHA256SUMS already exists, make sure it's exactly what we
224            # expect, error out if not
225            if diff -u all.SHA256SUMS "$temp_all"; then
226                echo "An all.SHA256SUMS file already exists for '${VERSION}' and is up-to-date."
227            else
228                shasum_already_exists all.SHA256SUMS
229                exit 1
230            fi
231        else
232            mv "$temp_all" all.SHA256SUMS
233        fi
234    else
235        # It is fine to have the codesigned outputs be missing (perhaps the
236        # detached codesigs have not been published yet), just print a log
237        # message instead of erroring out
238        echo "INFO: No codesigned outputs found for '${VERSION}', skipping..."
239    fi
240
241    if [ -z "$NO_SIGN" ]; then
242        echo "Signing SHA256SUMS to produce SHA256SUMS.asc"
243        for i in *.SHA256SUMS; do
244            if [ ! -e "$i".asc ]; then
245                ${GPG} --detach-sign \
246                       --digest-algo sha256 \
247                       --local-user "$gpg_key_name" \
248                       --armor \
249                       --output "$i".asc "$i"
250            else