Skip to content

Commit 6abcfa5

Browse files
ChristopherSchultzChristopherSchultz
committed
Add GPG signature verification to verify-release
1 parent ef2c48a commit 6abcfa5

File tree

1 file changed

+129
-0
lines changed

1 file changed

+129
-0
lines changed

‎build.xml‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4349,6 +4349,86 @@ Signature mismatch for @{src-or-bin}/@{basefile}:
43494349
</sequential>
43504350
</macrodef>
43514351

4352+
<macrodef name="compare-signatures">
4353+
<attribute name="basefile" />
4354+
<attribute name="num" />
4355+
<attribute name="src-or-bin" />
4356+
<sequential>
4357+
<exec executable="${gpg.exec}"
4358+
failonerror="false"
4359+
resultproperty="gpgverify-@{num}"
4360+
discardOutput="true"
4361+
logError="true">
4362+
<!-- Only use the keyring from our own repository -->
4363+
<arg value="--no-default-keyring" />
4364+
<arg value="--primary-keyring" />
4365+
<arg value="${tomcat.release.verify}/apache-keys" />
4366+
<!-- Always trust keys in this keyring, even without explicit trust -->
4367+
<arg value="--trust-model" />
4368+
<arg value="always" />
4369+
<arg value="--verify"/>
4370+
<arg value="${tomcat.release.verify}/@{basefile}.asc" />
4371+
<arg value="output/release/v${version}/@{src-or-bin}/@{basefile}" />
4372+
</exec>
4373+
4374+
<condition property="validsignature-@{num}">
4375+
<equals arg1="${gpgverify-@{num}}" arg2="0"/>
4376+
</condition>
4377+
4378+
<echo if:set="validsignature-@{num}">
4379+
Valid signature for @{src-or-bin}/@{basefile}
4380+
</echo>
4381+
<echo unless:set="validsignature-@{num}">
4382+
4383+
4384+
4385+
**********************************************
4386+
**********************************************
4387+
Invalid signature for @{src-or-bin}/@{basefile}
4388+
**********************************************
4389+
**********************************************
4390+
4391+
4392+
4393+
</echo>
4394+
</sequential>
4395+
</macrodef>
4396+
4397+
<macrodef name="get-release-signature">
4398+
<attribute name="basefile" />
4399+
<attribute name="src-or-bin" />
4400+
4401+
<sequential>
4402+
<local name="success" />
4403+
4404+
<!-- Release hashes can be either 'released' or staged-for-release -->
4405+
<!-- First, try to find a released version hash. -->
4406+
<antcall target="trydownload">
4407+
<param name="sourcefile" value="https://dist.apache.org/repos/dist/release/tomcat/tomcat-${version.major}/v${version}/@{src-or-bin}/@{basefile}.asc" />
4408+
<param name="destfile" value="${tomcat.release.verify}/@{basefile}.asc" />
4409+
</antcall>
4410+
<!-- If necessary, try to find a dev version hash. -->
4411+
<antcall target="trydownload">
4412+
<param name="sourcefile" value="https://dist.apache.org/repos/dist/dev/tomcat/tomcat-${version.major}/v${version}/@{src-or-bin}/@{basefile}.asc" />
4413+
<param name="destfile" value="${tomcat.release.verify}/@{basefile}.asc" />
4414+
</antcall>
4415+
4416+
<condition property="success">
4417+
<or>
4418+
<available file="${tomcat.release.verify}/@{basefile}.asc" />
4419+
<and>
4420+
<contains string="${version}" substring="11.0." /><!-- Super hack -->
4421+
<contains string="@{basefile}" substring="x86" />
4422+
</and>
4423+
</or>
4424+
</condition>
4425+
4426+
<fail unless="success">
4427+
Unable to locate release signature for @{basefile}
4428+
</fail>
4429+
</sequential>
4430+
</macrodef>
4431+
43524432
<target name="verify-release" depends="-check-release-toolchain-versions, -require-release-toolchain-versions" description="Verifies a release build against published hashes.">
43534433

43544434
<available property="released" file="build.properties.release" />
@@ -4363,6 +4443,16 @@ It appears there are no build artifacts to verify. Please run 'ant release' firs
43634443
</fail>
43644444
<delete dir="${tomcat.release.verify}" />
43654445
<mkdir dir="${tomcat.release.verify}" />
4446+
<!-- <chmod dir="${tomcat.release.verify}" perm="700"/>--><!-- To make gpg happy -->
4447+
4448+
<exec executable="gpg" failonerror="false"><!-- Not sure why this returns 2 on 'success?' -->
4449+
<arg value="--no-default-keyring" />
4450+
<arg value="--primary-keyring" />
4451+
<arg value="${tomcat.release.verify}/apache-keys"/>
4452+
<arg value="--import"/>
4453+
<arg value="KEYS"/>
4454+
</exec>
4455+
43664456
<get-release-hash src-or-bin="bin" basefile="${final.name}-deployer.tar.gz" />
43674457
<get-release-hash src-or-bin="bin" basefile="${final.name}-deployer.zip" />
43684458
<get-release-hash src-or-bin="bin" basefile="${final.name}-fulldocs.tar.gz" />
@@ -4374,6 +4464,17 @@ It appears there are no build artifacts to verify. Please run 'ant release' firs
43744464
<get-release-hash src-or-bin="src" basefile="${final-src.name}.tar.gz" />
43754465
<get-release-hash src-or-bin="src" basefile="${final-src.name}.zip" />
43764466

4467+
<get-release-signature src-or-bin="bin" basefile="${final.name}-deployer.tar.gz" />
4468+
<get-release-signature src-or-bin="bin" basefile="${final.name}-deployer.zip" />
4469+
<get-release-signature src-or-bin="bin" basefile="${final.name}-fulldocs.tar.gz" />
4470+
<get-release-signature src-or-bin="bin" basefile="${final.name}-windows-x64.zip" />
4471+
<get-release-signature src-or-bin="bin" basefile="${final.name}-windows-x86.zip" />
4472+
<get-release-signature src-or-bin="bin" basefile="${final.name}.exe" />
4473+
<get-release-signature src-or-bin="bin" basefile="${final.name}.tar.gz" />
4474+
<get-release-signature src-or-bin="bin" basefile="${final.name}.zip" />
4475+
<get-release-signature src-or-bin="src" basefile="${final-src.name}.tar.gz" />
4476+
<get-release-signature src-or-bin="src" basefile="${final-src.name}.zip" />
4477+
43774478
<compare-hashes num="1" src-or-bin="bin" basefile="${final.name}-deployer.tar.gz" />
43784479
<compare-hashes num="2" src-or-bin="bin" basefile="${final.name}-deployer.zip" />
43794480
<compare-hashes num="3" src-or-bin="bin" basefile="${final.name}-fulldocs.tar.gz" />
@@ -4385,6 +4486,23 @@ It appears there are no build artifacts to verify. Please run 'ant release' firs
43854486
<compare-hashes num="9" src-or-bin="src" basefile="${final-src.name}.tar.gz" />
43864487
<compare-hashes num="10" src-or-bin="src" basefile="${final-src.name}.zip" />
43874488

4489+
<echo>
4490+
Don't worry if there are a bunch of "WARNING: untrusted key" warnings below.
4491+
It's just because the KEYS -&gt; apache-keys import doesn't contain any ownertrust
4492+
information.
4493+
</echo>
4494+
4495+
<compare-signatures num="1" src-or-bin="bin" basefile="${final.name}-deployer.tar.gz" />
4496+
<compare-signatures num="2" src-or-bin="bin" basefile="${final.name}-deployer.zip" />
4497+
<compare-signatures num="3" src-or-bin="bin" basefile="${final.name}-fulldocs.tar.gz" />
4498+
<compare-signatures num="4" src-or-bin="bin" basefile="${final.name}-windows-x64.zip" />
4499+
<compare-signatures num="5" src-or-bin="bin" basefile="${final.name}-windows-x86.zip" />
4500+
<compare-signatures num="6" src-or-bin="bin" basefile="${final.name}.exe" />
4501+
<compare-signatures num="7" src-or-bin="bin" basefile="${final.name}.tar.gz" />
4502+
<compare-signatures num="8" src-or-bin="bin" basefile="${final.name}.zip" />
4503+
<compare-signatures num="9" src-or-bin="src" basefile="${final-src.name}.tar.gz" />
4504+
<compare-signatures num="10" src-or-bin="src" basefile="${final-src.name}.zip" />
4505+
43884506
<!--
43894507
<echo>
43904508
reproducible-1=${reproducible-1}
@@ -4417,6 +4535,17 @@ reproducible-10=${reproducible-10}
44174535
<isset property="reproducible-8" />
44184536
<isset property="reproducible-9" />
44194537
<isset property="reproducible-10" />
4538+
4539+
<isset property="validsignature-1" />
4540+
<isset property="validsignature-2" />
4541+
<isset property="validsignature-3" />
4542+
<isset property="validsignature-4" />
4543+
<isset property="validsignature-5" />
4544+
<isset property="validsignature-6" />
4545+
<isset property="validsignature-7" />
4546+
<isset property="validsignature-8" />
4547+
<isset property="validsignature-9" />
4548+
<isset property="validsignature-10" />
44204549
</and>
44214550
</condition>
44224551

0 commit comments

Comments
 (0)