Add release verification tooling (#108)

Co-authored-by: Gilcimar Duarte <ti@gpm.infra>

1 files changed, 115 insertions, 0 deletions

diff --git a/scripts/verify-release.sh b/scripts/verify-release.sh
new file mode 100755
index 0000000..23e71d1
--- /dev/null
+++ b/scripts/verify-release.sh
@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo="Bitflash-sh/bitflash"
+tag="${1:-latest}"
+require_signature=0
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/verify-release.sh [tag|latest] [--require-signature]
+
+Downloads the release checksum file and every asset named in it, then verifies:
+  1. SHA256SUMS.asc, if present, against SHA256SUMS with gpg.
+  2. SHA256SUMS against the downloaded assets.
+
+Use --require-signature for release audits. Without it, older releases that
+ship only SHA256SUMS are checked for integrity and reported as unsigned.
+EOF
+}
+
+for arg in "${@:2}"; do
+  case "$arg" in
+    --require-signature) require_signature=1 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "unknown option: $arg" >&2; usage >&2; exit 2 ;;
+  esac
+done
+
+if [ "$tag" = "-h" ] || [ "$tag" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+need() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "missing required command: $1" >&2
+    exit 1
+  fi
+}
+
+need sed
+need awk
+
+if command -v sha256sum >/dev/null 2>&1; then
+  sha_check=(sha256sum -c SHA256SUMS)
+elif command -v shasum >/dev/null 2>&1; then
+  sha_check=(shasum -a 256 -c SHA256SUMS)
+else
+  echo "missing required command: sha256sum or shasum" >&2
+  exit 1
+fi
+
+download() {
+  local url="$1"
+  local out="$2"
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL "$url" -o "$out"
+  elif command -v wget >/dev/null 2>&1; then
+    wget -q "$url" -O "$out"
+  else
+    echo "missing required command: curl or wget" >&2
+    exit 1
+  fi
+}
+
+if [ "$tag" = "latest" ]; then
+  tag="$(download "https://api.github.com/repos/$repo/releases/latest" - |
+    sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' |
+    head -1)"
+  if [ -z "$tag" ]; then
+    echo "could not resolve latest release tag" >&2
+    exit 1
+  fi
+fi
+
+workdir="$(mktemp -d "${TMPDIR:-/tmp}/bitflash-release-verify.XXXXXX")"
+cleanup() { rm -rf "$workdir"; }
+trap cleanup EXIT
+
+base_url="https://github.com/$repo/releases/download/$tag"
+
+echo "Verifying Bitflash $tag"
+echo "Working directory: $workdir"
+cd "$workdir"
+
+download "$base_url/SHA256SUMS" SHA256SUMS
+
+if download "$base_url/SHA256SUMS.asc" SHA256SUMS.asc 2>/dev/null; then
+  if ! command -v gpg >/dev/null 2>&1; then
+    echo "SHA256SUMS.asc exists, but gpg is not installed" >&2
+    exit 1
+  fi
+  gpg --verify SHA256SUMS.asc SHA256SUMS
+  echo "Signature OK"
+else
+  if [ "$require_signature" -eq 1 ]; then
+    echo "release does not publish SHA256SUMS.asc" >&2
+    exit 1
+  fi
+  echo "WARNING: no SHA256SUMS.asc found; checking hashes only"
+fi
+
+awk '{print $2}' SHA256SUMS | while IFS= read -r file; do
+  file="${file#\*}"
+  file="${file#./}"
+  [ -z "$file" ] && continue
+  case "$file" in
+    */*|..*) echo "refusing unexpected checksum path: $file" >&2; exit 1 ;;
+  esac
+  echo "Downloading $file"
+  download "$base_url/$file" "$file"
+done
+
+"${sha_check[@]}"
+echo "Release assets OK"