1acb22a872
move script to pkg dir, add hint to script in pkg def remove unneeded script deps add extended bash error checking rename DIR -> TMPDIR remove TMPDIR on exit strip whitespace, simplify comments gpg2 -> gpg latesttagelectrs -> latest tmpdir: don't use XDG_RUNTIME_DIR XDG_RUNTIME_DIR is often in RAM and shouldn't be used for larger workloads like repo downlaods verify fingerprint of the imported key remove trailing '-' in output simplify output Hide --fetch-key output Output is not relevant to user, looks better without it More accurately describe ./get-sha256 function User might think that ./get-sha256 automatically updates sha256 in default.nix Fetch key from sks keyservers instead of keybase.io Using --recv-key simplifies getting the right key, and only the right key, greatly. I try to refrain from using sks keyservers, but the certificate spamming attack shouldn't be an issue in this case because we create a temporary keychain just for the verificaiton. remove unneeded cargoDepsHook Make clang nativeBuildInput instead of buildInput
25 lines
834 B
Bash
Executable File
25 lines
834 B
Bash
Executable File
#! /usr/bin/env nix-shell
|
|
#! nix-shell -i bash -p git gnupg
|
|
set -euo pipefail
|
|
|
|
TMPDIR="$(mktemp -d -p /tmp)"
|
|
trap "rm -rf $TMPDIR" EXIT
|
|
cd $TMPDIR
|
|
|
|
echo "Fetching latest release"
|
|
git clone https://github.com/romanz/electrs 2> /dev/null
|
|
cd electrs
|
|
latest=$(git describe --tags `git rev-list --tags --max-count=1`)
|
|
echo "Latest release is ${latest}"
|
|
|
|
# GPG verification
|
|
export GNUPGHOME=$TMPDIR
|
|
echo "Fetching Roman Zeyde's Key"
|
|
gpg --keyserver hkps://hkps.pool.sks-keyservers.net --recv-keys 15c8c3574ae4f1e25f3f35c587cae5fa46917cbb 2> /dev/null
|
|
echo "Verifying latest release"
|
|
git verify-tag ${latest}
|
|
|
|
echo "tag: ${latest}"
|
|
# The prefix option is necessary because GitHub prefixes the archive contents in this format
|
|
echo "sha256: $(git archive --format tar.gz --prefix=electrs-"${latest//v}"/ ${latest} | sha256sum | cut -d\ -f1)"
|