verify.sh raw

   1  #!/bin/sh
   2  
   3  MANIFEST_URL="https://getalby.com/install/hub/manifest.txt"
   4  SIGNATURE_URL="https://getalby.com/install/hub/manifest.txt.asc"
   5  
   6  verify_package() {
   7    archive_file="${1}"
   8    filename_in_manifest="${2}"
   9    response=""
  10  
  11    while true; do
  12      printf "Verify package signature and integrity? (Y/N): "
  13      read response
  14      case "$response" in
  15        [Yy]*) break ;;
  16        [Nn]*)
  17          echo "Verification skipped."
  18          return 0
  19          ;;
  20        *) echo "Invalid input. Please enter Y or N." ;;
  21      esac
  22    done
  23  
  24    for cmd in gpg sha256sum; do
  25      if ! command -v "$cmd" > /dev/null 2>&1; then
  26        echo "❌ Required command '$cmd' is not available." >&2
  27        return 1
  28      fi
  29    done
  30  
  31    echo "Downloading manifest file..."
  32    if ! wget -q -O manifest.txt "$MANIFEST_URL"; then
  33      echo "❌ Failed to download manifest file." >&2
  34      return 1
  35    fi
  36  
  37    echo "Downloading manifest signature file..."
  38    if ! wget -q -O manifest.txt.asc "$SIGNATURE_URL"; then
  39      echo "❌ Failed to download manifest signature file." >&2
  40      return 1
  41    fi
  42  
  43    if ! gpg --batch --verify "manifest.txt.asc" "manifest.txt"; then
  44      echo "❌ GPG signature verification failed!" >&2
  45      echo "Visit https://github.com/getAlby/hub/releases for more information on how to verify the release" >&2
  46      return 1
  47    fi
  48  
  49    expected_hash=$(grep "${filename_in_manifest}" "manifest.txt" | awk '{print $1}') || true
  50    if [ -z "$expected_hash" ]; then
  51      echo "❌ No hash entry found for ${filename_in_manifest} in the manifest." >&2
  52      return 1
  53    fi
  54  
  55    actual_hash=$(sha256sum "$archive_file" | awk '{print $1}')
  56  
  57    if [ "$expected_hash" != "$actual_hash" ]; then
  58      echo "❌ SHA256 hash mismatch! The file may be corrupted or tampered with." >&2
  59      return 1
  60    fi
  61  
  62    echo "✅ Verification successful. The package is authentic and intact."
  63    return 0
  64  }
  65  
  66  if [ $# -ne 2 ]; then
  67    echo "Usage: $0 <archive_file> <filename_in_manifest>"
  68    exit 1
  69  fi
  70  
  71  if ! verify_package "$1" "$2"; then
  72    exit 1
  73  fi
  74