mirror of
https://github.com/restic/restic.git
synced 2025-11-03 23:00:59 +00:00
137 lines
4 KiB
Bash
Executable file
137 lines
4 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ $# -lt 2 ]]; then
|
|
echo "Usage: $0 restic_version go_version"
|
|
exit 1
|
|
fi
|
|
|
|
restic_version="$1"
|
|
go_version="$2"
|
|
|
|
# invalid if zero
|
|
is_valid=1
|
|
set_invalid() {
|
|
echo $1
|
|
is_valid=0
|
|
}
|
|
|
|
tmpdir="$(mktemp -d -p .)"
|
|
cd "${tmpdir}"
|
|
echo -e "Running checks in ${tmpdir}\n"
|
|
|
|
highlight() {
|
|
echo "@@${1//?/@}@@"
|
|
echo "@ ${1} @"
|
|
echo "@@${1//?/@}@@"
|
|
}
|
|
|
|
|
|
highlight "Verifying release self-consistency"
|
|
|
|
curl -OLSs https://github.com/restic/restic/releases/download/v${restic_version}/restic-${restic_version}.tar.gz.asc
|
|
# tarball is downloaded while processing the SHA256SUMS
|
|
curl -OLSs https://github.com/restic/restic/releases/download/v${restic_version}/SHA256SUMS.asc
|
|
curl -OLSs https://github.com/restic/restic/releases/download/v${restic_version}/SHA256SUMS
|
|
|
|
export GNUPGHOME=$PWD/gnupg
|
|
mkdir -p 700 $GNUPGHOME
|
|
curl -OLSs https://restic.net/gpg-key-alex.asc
|
|
gpg --import gpg-key-alex.asc
|
|
gpg --verify SHA256SUMS.asc SHA256SUMS
|
|
|
|
for i in $(cat SHA256SUMS | cut -d " " -f 3 ) ; do
|
|
echo "Downloading $i"
|
|
curl -OLSs https://github.com/restic/restic/releases/download/v${restic_version}/"$i"
|
|
done
|
|
shasum -a256 -c SHA256SUMS || set_invalid "WARNING: RELEASE BINARIES DO NOT MATCH SHA256SUMS!"
|
|
gpg --verify restic-${restic_version}.tar.gz.asc restic-${restic_version}.tar.gz
|
|
# TODO verify that the release does not contain any unexpected files
|
|
|
|
|
|
highlight "Verifying tarball matches tagged commit"
|
|
|
|
tar xzf "restic-${restic_version}.tar.gz"
|
|
git clone -b "v${restic_version}" https://github.com/restic/restic.git
|
|
rm -rf restic/.git
|
|
diff -r restic restic-${restic_version}
|
|
|
|
|
|
highlight "Regenerating builder container"
|
|
|
|
git clone https://github.com/restic/builder.git
|
|
docker pull debian:stable
|
|
docker build --no-cache -t restic/builder:tmp --build-arg GO_VERSION=${go_version} builder
|
|
|
|
|
|
highlight "Reproducing release binaries"
|
|
|
|
mkdir output
|
|
docker run --rm \
|
|
--volume "$PWD/restic-${restic_version}:/restic" \
|
|
--volume "$PWD/output:/output" \
|
|
restic/builder:tmp \
|
|
go run helpers/build-release-binaries/main.go --version "${restic_version}"
|
|
|
|
cp "restic-${restic_version}.tar.gz" output
|
|
cp SHA256SUMS output
|
|
|
|
# check that all release binaries have been reproduced successfully
|
|
(cd output && shasum -a256 -c SHA256SUMS) || set_invalid "WARNING: REPRODUCED BINARIES DO NOT MATCH RELEASE BINARIES!"
|
|
# and that the SHA256SUMS files does not miss binaries
|
|
for i in output/restic* ; do grep "$(basename "$i")" SHA256SUMS > /dev/null || set_invalid "WARNING: $i MISSING FROM RELEASE SHA256SUMS FILE!" ; done
|
|
|
|
|
|
extract_docker() {
|
|
image=$1
|
|
docker_platform=$2
|
|
restic_platform=$3
|
|
out=restic_${restic_version}_linux_${restic_platform}.bz2
|
|
|
|
# requires at least docker 25.0
|
|
docker image pull --platform "linux/${docker_platform}" ${image}:${restic_version} > /dev/null
|
|
docker image save ${image}:${restic_version} -o docker.tar
|
|
|
|
mkdir img
|
|
tar xvf docker.tar -C img --wildcards blobs/sha256/\* > /dev/null
|
|
rm docker.tar
|
|
for i in img/blobs/sha256/*; do
|
|
tar -xvf "$i" -C img usr/bin/restic 2> /dev/null 1>&2 || true
|
|
if [[ -f img/usr/bin/restic ]]; then
|
|
if [[ -f restic-docker ]]; then
|
|
set_invalid "WARNING: CONTAINER CONTAINS MULTIPLE RESTIC BINARIES"
|
|
fi
|
|
mv img/usr/bin/restic restic-docker
|
|
fi
|
|
done
|
|
|
|
rm -rf img
|
|
bzip2 restic-docker
|
|
mv restic-docker.bz2 docker/${out}
|
|
grep ${out} SHA256SUMS >> docker/SHA256SUMS
|
|
}
|
|
|
|
ctr=0
|
|
for img in restic/restic ghcr.io/restic/restic; do
|
|
highlight "Verifying binaries in docker containers from $img"
|
|
mkdir docker
|
|
|
|
extract_docker "$img" arm/v7 arm
|
|
extract_docker "$img" arm64 arm64
|
|
extract_docker "$img" 386 386
|
|
extract_docker "$img" amd64 amd64
|
|
|
|
(cd docker && shasum -a256 -c SHA256SUMS) || set_invalid "WARNING: DOCKER CONTAINER DOES NOT CONTAIN RELEASE BINARIES!"
|
|
|
|
mv docker docker-$(( ctr++ ))
|
|
done
|
|
|
|
|
|
if [[ $is_valid -ne 1 ]]; then
|
|
highlight "Failed to reproduce some binaries, check the script output for details"
|
|
exit 1
|
|
else
|
|
cd ..
|
|
rm -rf "${tmpdir}"
|
|
fi
|