Inside Bitcoin

1#!/usr/bin/env bash
2# Copyright (c) The Bitcoin Core developers
3# Distributed under the MIT software license, see the accompanying
4# file COPYING or https://opensource.org/license/mit.
5export LC_ALL=C.UTF-8
6set -o errexit -o pipefail
7
8# Source the common prelude, which:
9#   1. Checks if we're at the top directory of the Bitcoin Core repository
10#   2. Defines a few common functions and variables
11#
12# shellcheck source=libexec/prelude.bash
13source "$(dirname "${BASH_SOURCE[0]}")/libexec/prelude.bash"
14
15
16###################
17## Sanity Checks ##
18###################
19
20################
21# Required non-builtin commands should be invokable
22################
23
24check_tools cat diff gpg
25
26################
27# Required env vars should be non-empty
28################
29
30cmd_usage() {
31cat <<EOF
32Synopsis:
33
34    env GUIX_SIGS_REPO=<path/to/guix.sigs> [ SIGNER=<signer> ] ./contrib/guix/guix-verify
35
36Example overriding signer's manifest to use as base
37
38    env GUIX_SIGS_REPO=/home/dongcarl/guix.sigs SIGNER=achow101 ./contrib/guix/guix-verify
39
40EOF
41}
42
43if [ -z "$GUIX_SIGS_REPO" ]; then
44    cmd_usage
45    exit 1
46fi
47
48################
49# GUIX_SIGS_REPO should exist as a directory
50################
51
52if [ ! -d "$GUIX_SIGS_REPO" ]; then
53cat << EOF
54ERR: The specified GUIX_SIGS_REPO is not an existent directory:
55
56    '$GUIX_SIGS_REPO'
57
58Hint: Please clone the guix.sigs repository and point to it with the
59      GUIX_SIGS_REPO environment variable.
60
61EOF
62cmd_usage
63exit 1
64fi
65
66##############
67##  Verify  ##
68##############
69
70OUTSIGDIR_BASE="${GUIX_SIGS_REPO}/${VERSION}"
71echo "Looking for signature directories in '${OUTSIGDIR_BASE}'"
72echo ""
73
74# Usage: verify compare_manifest current_manifest
75verify() {
76    local compare_manifest="$1"
77    local current_manifest="$2"
78    if ! gpg --quiet --batch --verify "$current_manifest".asc "$current_manifest" 1>&2; then
79        echo "ERR: Failed to verify GPG signature in '${current_manifest}'"
80        echo ""
81        echo "Hint: Either the signature is invalid or the public key is missing"
82        echo ""
83        failure=1
84    elif ! diff --report-identical "$compare_manifest" "$current_manifest" 1>&2; then
85        echo "ERR: The SHA256SUMS attestation in these two directories differ:"
86        echo "    '${compare_manifest}'"
87        echo "    '${current_manifest}'"
88        echo ""
89        failure=1
90    else
91        echo "Verified: '${current_manifest}'"
92        echo ""
93    fi
94}
95
96shopt -s nullglob
97all_noncodesigned=( "$OUTSIGDIR_BASE"/*/noncodesigned.SHA256SUMS )
98shopt -u nullglob
99
100echo "--------------------"
101echo ""
102if (( ${#all_noncodesigned[@]} )); then
103    compare_noncodesigned="${all_noncodesigned[0]}"
104    if [[ -n "$SIGNER" ]]; then
105        signer_noncodesigned="$OUTSIGDIR_BASE/$SIGNER/noncodesigned.SHA256SUMS"
106        if [[ -f "$signer_noncodesigned" ]]; then
107            echo "Using $SIGNER's manifest as the base to compare against"
108            compare_noncodesigned="$signer_noncodesigned"
109        else
110            echo "Unable to find $SIGNER's manifest, using the first one found"
111        fi
112    else
113        echo "No SIGNER provided, using the first manifest found"
114    fi
115
116    for current_manifest in "${all_noncodesigned[@]}"; do
117        verify "$compare_noncodesigned" "$current_manifest"
118    done
119
120    echo "DONE: Checking output signatures for noncodesigned.SHA256SUMS"
121    echo ""
122else
123    echo "WARN: No signature directories with noncodesigned.SHA256SUMS found"
124    echo ""
125fi
126
127shopt -s nullglob
128all_all=( "$OUTSIGDIR_BASE"/*/all.SHA256SUMS )
129shopt -u nullglob
130
131echo "--------------------"
132echo ""
133if (( ${#all_all[@]} )); then
134    compare_all="${all_all[0]}"
135    if [[ -n "$SIGNER" ]]; then
136        signer_all="$OUTSIGDIR_BASE/$SIGNER/all.SHA256SUMS"
137        if [[ -f "$signer_all" ]]; then
138            echo "Using $SIGNER's manifest as the base to compare against"
139            compare_all="$signer_all"
140        else
141            echo "Unable to find $SIGNER's manifest, using the first one found"
142        fi
143    else
144        echo "No SIGNER provided, using the first manifest found"
145    fi
146
147    for current_manifest in "${all_all[@]}"; do
148        verify "$compare_all" "$current_manifest"
149    done
150
151    # Sanity check: there should be no entries that exist in
152    # noncodesigned.SHA256SUMS that doesn't exist in all.SHA256SUMS
153    if [[ "$(comm -23 <(sort "$compare_noncodesigned") <(sort "$compare_all") | wc -c)" -ne 0 ]]; then
154        echo "ERR: There are unique lines in noncodesigned.SHA256SUMS which"
155        echo "     do not exist in all.SHA256SUMS, something went very wrong."
156        exit 1
157    fi
158
159    echo "DONE: Checking output signatures for all.SHA256SUMS"
160    echo ""
161else
162    echo "WARN: No signature directories with all.SHA256SUMS found"
163    echo ""
164fi
165
166echo "===================="
167echo ""
168if (( ${#all_noncodesigned[@]} + ${#all_all[@]} == 0 )); then
169    echo "ERR: Unable to perform any verifications as no signature directories"
170    echo "     were found"
171    echo ""
172    exit 1
173fi
174
175if [ -n "$failure" ]; then
176    exit 1
177fi
178