43 lines
2.0 KiB
Bash
Executable File
43 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Checks a published release the way a customer site sees it: no token, only public URLs.
|
|
#
|
|
# bin/release-check.sh [version] default: Plugin::VERSION
|
|
#
|
|
# Fails unless releases/latest is that version, ZIP and .sig are public downloads below the repository's release
|
|
# URL (the only place GiteaUpdater accepts a package from), and the downloaded ZIP passes the signature check against
|
|
# the key built into the plugin.
|
|
#
|
|
# Environment: LIT_MCP_GITEA (default https://git.loosen-it.de), only to try the script against another server.
|
|
set -euo pipefail
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$root"
|
|
|
|
gitea="${LIT_MCP_GITEA:-https://git.loosen-it.de}"
|
|
repo="janniclas.loosen/WP-LIT-MCP"
|
|
version="${1:-$(sed -n "s/.*const VERSION = '\(.*\)';/\1/p" src/Plugin.php)}"
|
|
name="wp-lit-mcp-$version.zip"
|
|
|
|
fail() { echo "ABBRUCH: $*" >&2; exit 1; }
|
|
|
|
latest="$(curl -fsS "$gitea/api/v1/repos/$repo/releases/latest")" \
|
|
|| fail "releases/latest ist ohne Anmeldung nicht abrufbar (noch kein veröffentlichtes Release? Repo nicht öffentlich?)"
|
|
tag="$(jq -r .tag_name <<<"$latest")"
|
|
[[ "$tag" == "v$version" ]] || fail "releases/latest liefert '$tag', erwartet v$version"
|
|
|
|
asset_url() { jq -r --arg n "$1" '.assets[] | select(.name == $n) | .browser_download_url' <<<"$latest"; }
|
|
zip_url="$(asset_url "$name")"
|
|
sig_url="$(asset_url "$name.sig")"
|
|
for url in "$zip_url" "$sig_url"; do
|
|
[[ "$url" == "$gitea/$repo/releases/download/"* ]] || fail "Asset-URL fehlt oder liegt woanders: '$url'"
|
|
done
|
|
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "$work"' EXIT
|
|
curl -fsSL "$zip_url" -o "$work/$name" || fail "ZIP nicht ohne Anmeldung ladbar: $zip_url"
|
|
curl -fsSL "$sig_url" -o "$work/$name.sig" || fail "Signatur nicht ohne Anmeldung ladbar: $sig_url"
|
|
php bin/release-sign.php verify "$work/$name" "$work/$name.sig" >/dev/null \
|
|
|| fail "Das heruntergeladene Release besteht die Signaturprüfung nicht"
|
|
|
|
echo "Release v$version in Ordnung: öffentlich ladbar, Signatur gültig"
|