From 23824fe21e5878cef49aeff850a0d5480ff50ae0 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Thu, 25 Apr 2024 16:54:54 +0200 Subject: [PATCH 1/3] contrib/sign-release.sh: move signing functions into seperate file --- contrib/functions-sign.sh | 72 +++++++++++++++++++++++++++++++++++++ contrib/sign-release.sh | 75 +++------------------------------------ 2 files changed, 77 insertions(+), 70 deletions(-) create mode 100755 contrib/functions-sign.sh diff --git a/contrib/functions-sign.sh b/contrib/functions-sign.sh new file mode 100755 index 0000000..e965f38 --- /dev/null +++ b/contrib/functions-sign.sh @@ -0,0 +1,72 @@ +#!/usr/bin/env bash + +set -euo pipefail + +function split_manifest() { + local manifest upper lower + + manifest="$1" + upper="$2" + lower="$3" + + awk 'BEGIN { + sep = 0 + } + + /^---$/ { + sep = 1; + next + } + + { + if(sep == 0) { + print > "'"$upper"'" + } else { + print > "'"$lower"'" + } + }' "$manifest" +} + +function create_signature() { + local secret manifest upper lower + + manifest="$1" + secret="$2" + + upper="$(mktemp)" + lower="$(mktemp)" + + # Split manifest into upper and lower part + split_manifest "$manifest" "$upper" "$lower" + + # Sign upper part of manifest + ecdsasign "$upper" < "$secret" + + # Remove temporary files + rm -f "$upper" "$lower" +} + +function get_valid_signature() { + local public_key manifest upper lower + + manifest="$1" + public_key="$2" + + upper="$(mktemp)" + lower="$(mktemp)" + + # Split manifest into upper and lower part + split_manifest "$manifest" "$upper" "$lower" + + # Validate upper part of manifest + while read -r line + do + if ecdsaverify -s "$line" -p "$public_key" "$upper"; then + echo "$line" + break + fi + done < "$lower" + + # Remove temporary files + rm -f "$upper" "$lower" +} diff --git a/contrib/sign-release.sh b/contrib/sign-release.sh index 83f5331..f7610ae 100755 --- a/contrib/sign-release.sh +++ b/contrib/sign-release.sh @@ -1,82 +1,17 @@ -#!/bin/bash +#!/usr/bin/env bash set -euo pipefail +SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) + +source "${SCRIPT_DIR}/functions-sign.sh" + function usage() { echo "Usage: $0 " echo "Example: $0 2.0.0 /path/to/private-key.ecdsakey" exit 1 } -function split_manifest() { - local manifest upper lower - - manifest="$1" - upper="$2" - lower="$3" - - awk 'BEGIN { - sep = 0 - } - - /^---$/ { - sep = 1; - next - } - - { - if(sep == 0) { - print > "'"$upper"'" - } else { - print > "'"$lower"'" - } - }' "$manifest" -} - -function create_signature() { - local secret manifest upper lower - - manifest="$1" - secret="$2" - - upper="$(mktemp)" - lower="$(mktemp)" - - # Split manifest into upper and lower part - split_manifest "$manifest" "$upper" "$lower" - - # Sign upper part of manifest - ecdsasign "$upper" < "$secret" - - # Remove temporary files - rm -f "$upper" "$lower" -} - -function get_valid_signature() { - local public_key manifest upper lower - - manifest="$1" - public_key="$2" - - upper="$(mktemp)" - lower="$(mktemp)" - - # Split manifest into upper and lower part - split_manifest "$manifest" "$upper" "$lower" - - # Validate upper part of manifest - while read -r line - do - if ecdsaverify -s "$line" -p "$public_key" "$upper"; then - echo "$line" - break - fi - done < "$lower" - - # Remove temporary files - rm -f "$upper" "$lower" -} - function cleanup() { rm -rf "$TEMP_DIR" } From 997c378203324bf9e8291fa2472ad9ffbf6d12b3 Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Thu, 25 Apr 2024 16:35:43 +0200 Subject: [PATCH 2/3] contrib/check-release.sh: init helper script to determince who has signed a manifest --- contrib/check-release.sh | 60 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100755 contrib/check-release.sh diff --git a/contrib/check-release.sh b/contrib/check-release.sh new file mode 100755 index 0000000..9345421 --- /dev/null +++ b/contrib/check-release.sh @@ -0,0 +1,60 @@ +#!/usr/bin/env bash + +set -euo pipefail + +SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) + +source "${SCRIPT_DIR}/functions-sign.sh" + +declare -A SIGKEYS + +SIGKEYS["hexa-"]="c8e33aa86b1d3ad894d744d76232fa6325efb63672c3b972bb91f5197e2a96f9" +SIGKEYS["braack"]="52b8c8de3985035ffcb0246e537396906357d8d244930947e4bb2c3da370fff7" +SIGKEYS["andi-"]="73bea808dd08c77b4c68c80e9ebe10f5690459b77a4ad0e5074a4583e5775cbc" +SIGKEYS["fluxx"]="af9a8c08f975d54c9015d015668d3a084e61af43180cbe23def3f79c6e80b32c" +SIGKEYS["blocktrron"]="910ddca3b0561bebcb112ea20b714114fe1598b3dd376177fe1c38ed58b1477f" +SIGKEYS["noxnox"]="daa74de3bf1aa87301a28ac9081d021de0c92299ec457d177014a026c888d288" +SIGKEYS["tomh"]="bead63b9e44f5243e3030a37fdc0d1cd3efce65234c7bedfcff6ae6452d42e79" +SIGKEYS["skorpy"]="0ebac3d341673dbeb8b6d2499811ce7851516aae851d71067a3e16488dee44c7" +SIGKEYS["alex"]="5b8ce650fc50d845975567bd5418fcd5c091528e48e95cf0e2f0266ed509e013" +SIGKEYS["build.ffda.io"]="24f20f0e0d7711181c70c85a76dda08334a96acd631994ace9b61b57a159db7b" +SIGKEYS["github-actions-ci"]="cea1e84bf157d7362287fcd21d13de14634341e3d1ea7038000062743554dc88" + +function usage() { + echo "Usage: $0 " + echo "Example: $0 3.0.2 stable" + exit 1 +} + +function cleanup() { + rm -rf "$TEMP_DIR" +} + +RELEASE_VERSION="${1:-}" +BRANCH="${2:-}" + +[ -z "$RELEASE_VERSION" ] && usage +[ -z "$BRANCH" ] && usage + +# Create Temporary working directory +TEMP_DIR="$(mktemp -d)" + +MANIFEST_PATH="${TEMP_DIR}/checking.manifest" + +# Download released manifest archive +MANIFEST_URL="https://firmware.darmstadt.freifunk.net/images/${RELEASE_VERSION}/sysupgrade/${BRANCH}.manifest" +echo "Download manifest from $MANIFEST_URL" +curl -s -L -o "${MANIFEST_PATH}" "${MANIFEST_URL}" + +for name in "${!SIGKEYS[@]}" +do + valid_ci_signature="$(get_valid_signature "${MANIFEST_PATH}" "${SIGKEYS[$name]}")" + + # Check if manifest is signed with the key under test + if [ -n "$valid_ci_signature" ]; then + echo "Manifest is signed with the \"${name}\" key" + echo "Signature: $valid_ci_signature" + fi +done + +cleanup From a6527a2238da0c583c7a139b886ccb29550b72bb Mon Sep 17 00:00:00 2001 From: Tom Herbers Date: Fri, 26 Apr 2024 14:05:44 +0200 Subject: [PATCH 3/3] github: worklow: lint: shellcheck: allow external sources --- .github/workflows/lint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 6b41e31..eaa8e0b 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -30,7 +30,7 @@ jobs: - name: Install Dependencies run: sudo apt-get update && sudo apt-get install -y shellcheck - name: Validate Shell Scripts - run: shellcheck $SHELL_FILES + run: shellcheck --external-sources --source-path=SCRIPTDIR $SHELL_FILES image-customization: name: "Image-Customization"