passepartoutvpn
/
openssl-apple
mirror of https://github.com/passepartoutvpn/openssl-apple.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #40 from levigroker/levi/gpg_validation 

Perform GPG Signature Validation on the archive
This commit is contained in:
Davide De Rosa 2021-09-15 23:37:26 +02:00 committed by GitHub
parent 3597714d2c e6e4b76e60
commit 1f4c6c40d1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -6,6 +6,7 @@ lib
frameworks frameworks
include/openssl include/openssl
*.gz *.gz
*.gz.asc
*.framework *.framework
*.o *.o
*.pbxuser *.pbxuser

30
build-libssl.sh
View File

@ -218,6 +218,20 @@ finish_build_loop()
fi fi
} }
gpg_validate()
{
local TARGET=$1
local SIG=${2:-${TARGET}.asc}
GPG_B=$(which gpg)
if [ ! -x "${GPG_B}" ]; then
echo "WARN: No gpg executable found in PATH. Please consider installing gpg so archive signature validation can proceed."
return 1
fi
$GPG_B --keyserver keys.openpgp.org --keyserver-options auto-key-retrieve,include-subkeys --verify-options show-photos --verify "${SIG}" "${TARGET}"
}
# Init optional command line vars # Init optional command line vars
ARCHS="" ARCHS=""
BRANCH="" BRANCH=""
@ -449,9 +463,12 @@ echo
# Download OpenSSL when not present # Download OpenSSL when not present
OPENSSL_ARCHIVE_BASE_NAME="openssl-${VERSION}" OPENSSL_ARCHIVE_BASE_NAME="openssl-${VERSION}"
OPENSSL_ARCHIVE_FILE_NAME="${OPENSSL_ARCHIVE_BASE_NAME}.tar.gz" OPENSSL_ARCHIVE_FILE_NAME="${OPENSSL_ARCHIVE_BASE_NAME}.tar.gz"
OPENSSL_ARCHIVE_SIGNATURE_FILE_NAME="${OPENSSL_ARCHIVE_FILE_NAME}.asc"
if [ ! -e ${OPENSSL_ARCHIVE_FILE_NAME} ]; then if [ ! -e ${OPENSSL_ARCHIVE_FILE_NAME} ]; then
echo "Downloading ${OPENSSL_ARCHIVE_FILE_NAME}..." echo "Downloading ${OPENSSL_ARCHIVE_FILE_NAME}..."
OPENSSL_ARCHIVE_URL="https://www.openssl.org/source/${OPENSSL_ARCHIVE_FILE_NAME}" OPENSSL_ARCHIVE_BASE_URL="https://www.openssl.org/source"
OPENSSL_ARCHIVE_URL="${OPENSSL_ARCHIVE_BASE_URL}/${OPENSSL_ARCHIVE_FILE_NAME}"
OPENSSL_ARCHIVE_SIGNATURE_URL="${OPENSSL_ARCHIVE_BASE_URL}/${OPENSSL_ARCHIVE_SIGNATURE_FILE_NAME}"
# Check whether file exists here (this is the location of the latest version for each branch) # Check whether file exists here (this is the location of the latest version for each branch)
# -s be silent, -f return non-zero exit status on failure, -I get header (do not download) # -s be silent, -f return non-zero exit status on failure, -I get header (do not download)
@ -475,11 +492,22 @@ if [ ! -e ${OPENSSL_ARCHIVE_FILE_NAME} ]; then
# Archive was found, so proceed with download. # Archive was found, so proceed with download.
# -O Use server-specified filename for download # -O Use server-specified filename for download
curl ${CURL_OPTIONS} -O "${OPENSSL_ARCHIVE_URL}" curl ${CURL_OPTIONS} -O "${OPENSSL_ARCHIVE_URL}"
curl ${CURL_OPTIONS} -O "${OPENSSL_ARCHIVE_SIGNATURE_URL}"
else else
echo "Using ${OPENSSL_ARCHIVE_FILE_NAME}" echo "Using ${OPENSSL_ARCHIVE_FILE_NAME}"
fi fi
# Validate archive signature
if [ -e ${OPENSSL_ARCHIVE_SIGNATURE_FILE_NAME} ]; then
gpg_validate "${OPENSSL_ARCHIVE_FILE_NAME}" "${OPENSSL_ARCHIVE_SIGNATURE_FILE_NAME}"
if [ $? -ne 0 ]; then
echo "WARN: GPG signature validation was unsuccessful."
fi
else
echo "WARN: No GPG signature validation performed. (missing ${OPENSSL_ARCHIVE_SIGNATURE_FILE_NAME})"
fi
# Set reference to custom configuration (OpenSSL 1.1.1) # Set reference to custom configuration (OpenSSL 1.1.1)
# See: https://github.com/openssl/openssl/commit/afce395cba521e395e6eecdaf9589105f61e4411 # See: https://github.com/openssl/openssl/commit/afce395cba521e395e6eecdaf9589105f61e4411
export OPENSSL_LOCAL_CONFIG_DIR="${SCRIPTDIR}/config" export OPENSSL_LOCAL_CONFIG_DIR="${SCRIPTDIR}/config"