| 1 | #!/usr/bin/env bash |
| 2 | set -euo pipefail |
| 3 | |
| 4 | manifest="${1:-}" |
| 5 | asset_dir="${2:-}" |
| 6 | |
| 7 | if [ ! -f "$manifest" ] || [ ! -d "$asset_dir" ]; then |
| 8 | echo "usage: $0 MANIFEST ASSET_DIRECTORY" >&2 |
| 9 | exit 2 |
| 10 | fi |
| 11 | |
| 12 | entries="$(mktemp)" |
| 13 | trap 'rm -f "$entries"' EXIT |
| 14 | jq -er ' |
| 15 | [.platforms, .native_packages, (.downloads // {})] |
| 16 | | map(to_entries) |
| 17 | | add[] |
| 18 | | [.value.url, .value.sha256, (.value.size | tostring)] |
| 19 | | @tsv |
| 20 | ' "$manifest" >"$entries" |
| 21 | |
| 22 | while IFS=$'\t' read -r url expected_sha expected_size; do |
| 23 | name="${url##*/}" |
| 24 | if [[ ! "$name" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]]; then |
| 25 | echo "Desktop release manifest has an unsafe asset URL: $url" >&2 |
| 26 | exit 1 |
| 27 | fi |
| 28 | asset="$asset_dir/$name" |
| 29 | if [ ! -f "$asset" ]; then |
| 30 | echo "Desktop release manifest asset is missing: $name" >&2 |
| 31 | exit 1 |
| 32 | fi |
| 33 | actual_size="$(wc -c <"$asset" | tr -d '[:space:]')" |
| 34 | if [ "$actual_size" != "$expected_size" ]; then |
| 35 | echo "Desktop release manifest size does not match $name" >&2 |
| 36 | exit 1 |
| 37 | fi |
| 38 | actual_sha="$(shasum -a 256 "$asset" | awk '{print $1}')" |
| 39 | if [ "$actual_sha" != "$expected_sha" ]; then |
| 40 | echo "Desktop release manifest digest does not match $name" >&2 |
| 41 | exit 1 |
| 42 | fi |
| 43 | done <"$entries" |
| 44 |