From 6270d624cf6bc235b3e47bbbf5d49039fe1e172a Mon Sep 17 00:00:00 2001 From: Matt Corallo Date: Thu, 22 Jun 2017 13:44:31 -0400 Subject: [PATCH] Verify binaries from bitcoincore.org and bitcoin.org --- contrib/verifybinaries/verify.sh | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/contrib/verifybinaries/verify.sh b/contrib/verifybinaries/verify.sh index c2cc2b701..409f517c9 100755 --- a/contrib/verifybinaries/verify.sh +++ b/contrib/verifybinaries/verify.sh @@ -3,7 +3,8 @@ # Distributed under the MIT software license, see the accompanying # file COPYING or http://www.opensource.org/licenses/mit-license.php. -### This script attempts to download the signature file SHA256SUMS.asc from bitcoin.org +### This script attempts to download the signature file SHA256SUMS.asc from +### bitcoincore.org and bitcoin.org and compares them. ### It first checks if the signature passes, and then downloads the files specified in ### the file, and checks if the hashes of these files match those that are specified ### in the signature file. @@ -22,7 +23,9 @@ TMPFILE="hashes.tmp" SIGNATUREFILENAME="SHA256SUMS.asc" RCSUBDIR="test" -BASEDIR="https://bitcoin.org/bin/" +HOST1="https://bitcoincore.org" +HOST2="https://bitcoin.org" +BASEDIR="/bin/" VERSIONPREFIX="bitcoin-core-" RCVERSIONSTRING="rc" @@ -81,7 +84,7 @@ else fi #first we fetch the file containing the signature -WGETOUT=$(wget -N "$BASEDIR$SIGNATUREFILENAME" 2>&1) +WGETOUT=$(wget -N "$HOST1$BASEDIR$SIGNATUREFILENAME" 2>&1) #and then see if wget completed successfully if [ $? -ne 0 ]; then @@ -92,6 +95,22 @@ if [ $? -ne 0 ]; then exit 2 fi +WGETOUT=$(wget -N -O "$SIGNATUREFILENAME.2" "$HOST2$BASEDIR$SIGNATUREFILENAME" 2>&1) +if [ $? -ne 0 ]; then + echo "bitcoin.org failed to provide signature file, but bitcoincore.org did?" + echo "wget output:" + echo "$WGETOUT"|sed 's/^/\t/g' + clean_up $SIGNATUREFILENAME + exit 3 +fi + +SIGFILEDIFFS="$(diff $SIGNATUREFILENAME $SIGNATUREFILENAME.2)" +if [ "$SIGFILEDIFFS" != "" ]; then + echo "bitcoin.org and bitcoincore.org signature files were not equal?" + clean_up $SIGNATUREFILENAME $SIGNATUREFILENAME.2 + exit 4 +fi + #then we check it GPGOUT=$(gpg --yes --decrypt --output "$TMPFILE" "$SIGNATUREFILENAME" 2>&1) @@ -111,7 +130,7 @@ if [ $RET -ne 0 ]; then echo "gpg output:" echo "$GPGOUT"|sed 's/^/\t/g' - clean_up $SIGNATUREFILENAME $TMPFILE + clean_up $SIGNATUREFILENAME $SIGNATUREFILENAME.2 $TMPFILE exit "$RET" fi @@ -131,7 +150,7 @@ FILES=$(awk '{print $2}' "$TMPFILE") for file in $FILES do echo "Downloading $file" - wget --quiet -N "$BASEDIR$file" + wget --quiet -N "$HOST1$BASEDIR$file" done #check hashes @@ -149,7 +168,7 @@ fi if [ -n "$2" ]; then echo "Clean up the binaries" - clean_up $FILES $SIGNATUREFILENAME $TMPFILE + clean_up $FILES $SIGNATUREFILENAME $SIGNATUREFILENAME.2 $TMPFILE else echo "Keep the binaries in $WORKINGDIR" clean_up $TMPFILE