Skip to content

Commit fa99663

Browse files
laanwjlaanwj
committed
Merge #9940: Fix verify-commits on OSX, update for new bad Tree-SHA512, point travis to different keyservers
df5bae2 Update trusted-sha512-root-commit for new bad tree hash (Matt Corallo) efc06c2 If GNU sha512sum is missing, try perl shasum in verify-commits (Matt Corallo) 8ed849f Fix travis failing to fetch keys from the sks keyserver pool (Matt Corallo) fd5e905 Make verify-commits.sh non-recursive (Matt Corallo) Tree-SHA512: 457cc81d6e0a77ab32d030ecd058c59857f22cb998a1394593e115639081f3fdc74a6376035b77be0712ad5cb9143bc3f498b77e99eb66034492dbbb38c39bc6
2 parents 2cc0df1 + df5bae2 commit fa99663

File tree

3 files changed

+67
-63
lines changed

3 files changed

+67
-63
lines changed

‎.travis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ before_script:
5151
- if [ -n "$OSX_SDK" -a -f depends/sdk-sources/MacOSX${OSX_SDK}.sdk.tar.gz ]; then tar -C depends/SDKs -xf depends/sdk-sources/MacOSX${OSX_SDK}.sdk.tar.gz; fi
5252
- make $MAKEJOBS -C depends HOST=$HOST $DEP_OPTS
5353
script:
54-
- if [ "$CHECK_DOC" = 1 -a "$TRAVIS_REPO_SLUG" = "bitcoin/bitcoin" -a "$TRAVIS_PULL_REQUEST" = "false" ]; then while read LINE; do travis_retry gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys $LINE; done < contrib/verify-commits/trusted-keys; fi
54+
- if [ "$CHECK_DOC" = 1 -a "$TRAVIS_REPO_SLUG" = "bitcoin/bitcoin" -a "$TRAVIS_PULL_REQUEST" = "false" ]; then while read LINE; do travis_retry gpg --keyserver hkp://subset.pool.sks-keyservers.net --recv-keys $LINE; done < contrib/verify-commits/trusted-keys; fi
5555
- if [ "$CHECK_DOC" = 1 -a "$TRAVIS_REPO_SLUG" = "bitcoin/bitcoin" -a "$TRAVIS_PULL_REQUEST" = "false" ]; then git fetch --unshallow; fi
5656
- if [ "$CHECK_DOC" = 1 -a "$TRAVIS_REPO_SLUG" = "bitcoin/bitcoin" -a "$TRAVIS_PULL_REQUEST" = "false" ]; then contrib/verify-commits/verify-commits.sh; fi
5757
- export TRAVIS_COMMIT_LOG=`git log --format=fuller -1`

‎contrib/verify-commits/trusted-sha512-root-commit

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
f7ec7cfd38b543ba81ac7bed5b77f9a19739460b
1+
309bf16257b2395ce502017be627186b749ee749

‎contrib/verify-commits/verify-commits.sh

Lines changed: 65 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@
33
# Distributed under the MIT software license, see the accompanying
44
# file COPYING or http://www.opensource.org/licenses/mit-license.php.
55

6-
# Not technically POSIX-compliant due to use of "local", but almost every
7-
# shell anyone uses today supports it, so its probably fine
8-
96
DIR=$(dirname "$0")
107
[ "/${DIR#/}" != "$DIR" ] && DIR=$(dirname "$(pwd)/$0")
118

@@ -16,14 +13,36 @@ VERIFIED_SHA512_ROOT=$(cat "${DIR}/trusted-sha512-root-commit")
1613
REVSIG_ALLOWED=$(cat "${DIR}/allow-revsig-commits")
1714

1815
HAVE_FAILED=false
19-
IS_SIGNED () {
20-
if [ $1 = $VERIFIED_ROOT ]; then
21-
return 0;
16+
17+
HAVE_GNU_SHA512=1
18+
[ ! -x "$(which sha512sum)" ] && HAVE_GNU_SHA512=0
19+
20+
if [ x"$1" = "x" ]; then
21+
CURRENT_COMMIT="HEAD"
22+
else
23+
CURRENT_COMMIT="$1"
24+
fi
25+
26+
if [ "${CURRENT_COMMIT#* }" != "$CURRENT_COMMIT" ]; then
27+
echo "Commit must not contain spaces?" > /dev/stderr
28+
exit 1
29+
fi
30+
31+
VERIFY_TREE=0
32+
if [ x"$2" = "x--tree-checks" ]; then
33+
VERIFY_TREE=1
34+
fi
35+
36+
NO_SHA1=1
37+
PREV_COMMIT=""
38+
39+
while true; do
40+
if [ "$CURRENT_COMMIT" = $VERIFIED_ROOT ]; then
41+
echo "There is a valid path from "$CURRENT_COMMIT" to $VERIFIED_ROOT where all commits are signed!"
42+
exit 0;
2243
fi
2344

24-
VERIFY_TREE=$2
25-
NO_SHA1=$3
26-
if [ $1 = $VERIFIED_SHA512_ROOT ]; then
45+
if [ "$CURRENT_COMMIT" = $VERIFIED_SHA512_ROOT ]; then
2746
if [ "$VERIFY_TREE" = "1" ]; then
2847
echo "All Tree-SHA512s matched up to $VERIFIED_SHA512_ROOT" > /dev/stderr
2948
fi
@@ -37,92 +56,77 @@ IS_SIGNED () {
3756
export BITCOIN_VERIFY_COMMITS_ALLOW_SHA1=1
3857
fi
3958

40-
if [ "${REVSIG_ALLOWED#*$1}" != "$REVSIG_ALLOWED" ]; then
59+
if [ "${REVSIG_ALLOWED#*$CURRENT_COMMIT}" != "$REVSIG_ALLOWED" ]; then
4160
export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=1
4261
else
4362
export BITCOIN_VERIFY_COMMITS_ALLOW_REVSIG=0
4463
fi
4564

46-
if ! git -c "gpg.program=${DIR}/gpg.sh" verify-commit $1 > /dev/null; then
47-
return 1;
65+
if ! git -c "gpg.program=${DIR}/gpg.sh" verify-commit "$CURRENT_COMMIT" > /dev/null; then
66+
if [ "$PREV_COMMIT" != "" ]; then
67+
echo "No parent of $PREV_COMMIT was signed with a trusted key!" > /dev/stderr
68+
echo "Parents are:" > /dev/stderr
69+
PARENTS=$(git show -s --format=format:%P $PREV_COMMIT)
70+
for PARENT in $PARENTS; do
71+
git show -s $PARENT > /dev/stderr
72+
done
73+
else
74+
echo "$CURRENT_COMMIT was not signed with a trusted key!" > /dev/stderr
75+
fi
76+
exit 1
4877
fi
4978

50-
# We set $4 to 1 on the first call, always verifying the top of the tree
51-
if [ "$VERIFY_TREE" = 1 -o "$4" = "1" ]; then
79+
# We always verify the top of the tree
80+
if [ "$VERIFY_TREE" = 1 -o "$PREV_COMMIT" = "" ]; then
5281
IFS_CACHE="$IFS"
5382
IFS='
5483
'
55-
for LINE in $(git ls-tree --full-tree -r $1); do
84+
for LINE in $(git ls-tree --full-tree -r "$CURRENT_COMMIT"); do
5685
case "$LINE" in
5786
"12"*)
5887
echo "Repo contains symlinks" > /dev/stderr
5988
IFS="$IFS_CACHE"
60-
return 1
89+
exit 1
6190
;;
6291
esac
6392
done
6493
IFS="$IFS_CACHE"
6594

6695
FILE_HASHES=""
67-
for FILE in $(git ls-tree --full-tree -r --name-only $1 | LC_ALL=C sort); do
68-
HASH=$(git cat-file blob $1:"$FILE" | sha512sum | { read FIRST OTHER; echo $FIRST; } )
96+
for FILE in $(git ls-tree --full-tree -r --name-only "$CURRENT_COMMIT" | LC_ALL=C sort); do
97+
if [ "$HAVE_GNU_SHA512" = 1 ]; then
98+
HASH=$(git cat-file blob "$CURRENT_COMMIT":"$FILE" | sha512sum | { read FIRST OTHER; echo $FIRST; } )
99+
else
100+
HASH=$(git cat-file blob "$CURRENT_COMMIT":"$FILE" | shasum -a 512 | { read FIRST OTHER; echo $FIRST; } )
101+
fi
69102
[ "$FILE_HASHES" != "" ] && FILE_HASHES="$FILE_HASHES"'
70103
'
71104
FILE_HASHES="$FILE_HASHES$HASH $FILE"
72105
done
106+
107+
if [ "$HAVE_GNU_SHA512" = 1 ]; then
108+
TREE_HASH="$(echo "$FILE_HASHES" | sha512sum)"
109+
else
110+
TREE_HASH="$(echo "$FILE_HASHES" | shasum -a 512)"
111+
fi
73112
HASH_MATCHES=0
74-
MSG="$(git show -s --format=format:%B $1 | tail -n1)"
113+
MSG="$(git show -s --format=format:%B "$CURRENT_COMMIT" | tail -n1)"
75114

76115
case "$MSG -" in
77-
"Tree-SHA512: $(echo "$FILE_HASHES" | sha512sum)")
116+
"Tree-SHA512: $TREE_HASH")
78117
HASH_MATCHES=1;;
79118
esac
80119

81120
if [ "$HASH_MATCHES" = "0" ]; then
82-
echo "Tree-SHA512 did not match for commit $1" > /dev/stderr
83-
HAVE_FAILED=true
84-
return 1
121+
echo "Tree-SHA512 did not match for commit $CURRENT_COMMIT" > /dev/stderr
122+
exit 1
85123
fi
86124
fi
87125

88-
local PARENTS
89-
PARENTS=$(git show -s --format=format:%P $1)
126+
PARENTS=$(git show -s --format=format:%P "$CURRENT_COMMIT")
90127
for PARENT in $PARENTS; do
91-
if IS_SIGNED $PARENT $VERIFY_TREE $NO_SHA1 0; then
92-
return 0;
93-
fi
128+
PREV_COMMIT="$CURRENT_COMMIT"
129+
CURRENT_COMMIT="$PARENT"
94130
break
95131
done
96-
if ! "$HAVE_FAILED"; then
97-
echo "No parent of $1 was signed with a trusted key!" > /dev/stderr
98-
echo "Parents are:" > /dev/stderr
99-
for PARENT in $PARENTS; do
100-
git show -s $PARENT > /dev/stderr
101-
done
102-
HAVE_FAILED=true
103-
fi
104-
return 1;
105-
}
106-
107-
if [ x"$1" = "x" ]; then
108-
TEST_COMMIT="HEAD"
109-
else
110-
TEST_COMMIT="$1"
111-
fi
112-
113-
DO_CHECKOUT_TEST=0
114-
if [ x"$2" = "x--tree-checks" ]; then
115-
DO_CHECKOUT_TEST=1
116-
fi
117-
118-
IS_SIGNED "$TEST_COMMIT" "$DO_CHECKOUT_TEST" 1 1
119-
RES=$?
120-
if [ "$RES" = 1 ]; then
121-
if ! "$HAVE_FAILED"; then
122-
echo "$TEST_COMMIT was not signed with a trusted key!"
123-
fi
124-
else
125-
echo "There is a valid path from $TEST_COMMIT to $VERIFIED_ROOT where all commits are signed!"
126-
fi
127-
128-
exit $RES
132+
done

0 commit comments

Comments
 (0)