55 lines
2.4 KiB
Shell
55 lines
2.4 KiB
Shell
|
#!/bin/sh -eu
|
||
|
|
# check-aports.sh - verify the committed sha512sums of every aport's LOCAL
|
||
|
|
# source files (scripts, units, configs, patches) against the files actually
|
||
|
|
# in the aport directory.
|
||
|
|
#
|
||
|
|
# Why this exists: CI run 52 (2026-09-05) died after 57 minutes, at the point
|
||
|
|
# abuild reached fp6-vendor-blobs, because the extractor had been changed and
|
||
|
|
# its sha512sum had not. abuild finds that only when it gets to that aport;
|
||
|
|
# this finds it in under a second, before pmbootstrap does anything. build.sh
|
||
|
|
# runs it first; run it by hand before pushing too.
|
||
|
|
#
|
||
|
|
# Out of scope, by design: sources fetched from a URL (abuild verifies those
|
||
|
|
# against the same sums after fetching), and the aports whose sums build.sh
|
||
|
|
# regenerates at build time with 'pmbootstrap checksum' (their tarballs are
|
||
|
|
# generated there and do not exist here) - that list is read from build.sh so
|
||
|
|
# the two cannot drift apart.
|
||
|
|
cd "$(dirname "$0")"
|
||
|
|
regen=$(sed -n 's/^pmbootstrap checksum \([a-z0-9-]*\)$/\1/p' build.sh | tr '\n' ' ')
|
||
|
|
rc=0
|
||
|
|
for d in aports/*/*/; do
|
||
|
|
[ -f "$d/APKBUILD" ] || continue
|
||
|
|
d=${d%/}
|
||
|
|
case " $regen " in *" ${d##*/} "*) continue ;; esac
|
||
|
|
info=$(cd "$d" && sh -c '. ./APKBUILD; printf "%s\n" $source; printf "==\n"; printf "%s\n" "$sha512sums"' 2>/dev/null) || {
|
||
|
|
echo "$d: APKBUILD does not source cleanly" >&2; rc=1; continue
|
||
|
|
}
|
||
|
|
srcs=$(printf '%s\n' "$info" | sed '/^==$/,$d')
|
||
|
|
sums=$(printf '%s\n' "$info" | sed '1,/^==$/d')
|
||
|
|
for s in $srcs; do
|
||
|
|
case "$s" in
|
||
|
|
*://*) continue ;; # remote: abuild fetches and verifies
|
||
|
|
*::*) f=${s%%::*} ;;
|
||
|
|
*) f=${s##*/} ;;
|
||
|
|
esac
|
||
|
|
# a local source may sit in a subdirectory (rules/00_log_all.nft);
|
||
|
|
# the sums entry is keyed by its basename either way
|
||
|
|
path="$d/$s"; [ -f "$path" ] || path="$d/$f"
|
||
|
|
want=$(printf '%s\n' "$sums" | awk -v f="$f" '$2==f{print $1}')
|
||
|
|
[ "$want" = REPLACED_BY_CI ] && continue
|
||
|
|
if [ ! -f "$path" ]; then
|
||
|
|
echo "$d: local source '$s' is missing" >&2; rc=1; continue
|
||
|
|
fi
|
||
|
|
if [ -z "$want" ]; then
|
||
|
|
echo "$d: '$f' has no sha512sums entry" >&2; rc=1; continue
|
||
|
|
fi
|
||
|
|
have=$(sha512sum "$path" | awk '{print $1}')
|
||
|
|
if [ "$want" != "$have" ]; then
|
||
|
|
echo "$d: sha512 MISMATCH for '$f' (APKBUILD has ${want%"${want#????????????????}"}..., file is ${have%"${have#????????????????}"}...)" >&2
|
||
|
|
echo "$d: fix: update the sha512sums entry to: $have $f" >&2
|
||
|
|
rc=1
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
done
|
||
|
|
[ "$rc" = 0 ] && echo "check-aports: all local source checksums match"
|
||
|
|
exit $rc
|