Skip to content

R
ruby-build
Commit fb5e2b1a by Thomas Johansen Committed by Mislav Marohnić
Options

Replace MD5 commands with SHA2 equivalents 

A more secure hashing algorithm makes it less feasible to serve up a
modified tarball that matches the same checksum.

See the discussion in #548
parent 846cad88
Showing with 75 additions and 58 deletions
bin/ruby-build
...@@ -166,14 +166,31 @@ make_package() { ...@@ -166,14 +166,31 @@ make_package() {
popd >&4 popd >&4
} }
compute_sha2() {
local output
if type shasum &>/dev/null; then
output="$(shasum -a 256 -b)" || return 1
echo "${output% *}"
elif type openssl &>/dev/null; then
output="$(openssl dgst -sha256)" || return 1
echo "${output##* }"
elif type sha256sum &>/dev/null; then
output="$(sha256sum --quiet)" || return 1
echo "${output% *}"
else
return 1
fi
}
compute_md5() { compute_md5() {
local output
if type md5 &>/dev/null; then if type md5 &>/dev/null; then
md5 -q md5 -q
elif type openssl &>/dev/null; then elif type openssl &>/dev/null; then
local output="$(openssl md5)" output="$(openssl md5)" || return 1
echo "${output##* }" echo "${output##* }"
elif type md5sum &>/dev/null; then elif type md5sum &>/dev/null; then
local output="$(md5sum -b)" output="$(md5sum -b)" || return 1
echo "${output% *}" echo "${output% *}"
else else
return 1 return 1
...@@ -181,8 +198,8 @@ compute_md5() { ...@@ -181,8 +198,8 @@ compute_md5() {
} }
verify_checksum() { verify_checksum() {
# If there's no MD5 support, return success # If there's no SHA2 support, return success
[ -n "$HAS_MD5_SUPPORT" ] || return 0 [ -n "$HAS_SHA2_SUPPORT" ] || return 0
# If the specified filename doesn't exist, return success # If the specified filename doesn't exist, return success
local filename="$1" local filename="$1"
...@@ -193,7 +210,7 @@ verify_checksum() { ...@@ -193,7 +210,7 @@ verify_checksum() {
[ -n "$expected_checksum" ] || return 0 [ -n "$expected_checksum" ] || return 0
# If the computed checksum is empty, return failure # If the computed checksum is empty, return failure
local computed_checksum=`echo "$(compute_md5 < "$filename")" | tr [A-Z] [a-z]` local computed_checksum=`echo "$(compute_sha2 < "$filename")" | tr [A-Z] [a-z]`
[ -n "$computed_checksum" ] || return 1 [ -n "$computed_checksum" ] || return 1
if [ "$expected_checksum" != "$computed_checksum" ]; then if [ "$expected_checksum" != "$computed_checksum" ]; then
...@@ -983,10 +1000,10 @@ if [ -n "$RUBY_BUILD_SKIP_MIRROR" ]; then ...@@ -983,10 +1000,10 @@ if [ -n "$RUBY_BUILD_SKIP_MIRROR" ]; then
unset RUBY_BUILD_MIRROR_URL unset RUBY_BUILD_MIRROR_URL
fi fi
if echo test | compute_md5 >/dev/null; then if echo test | compute_sha2 >/dev/null; then
HAS_MD5_SUPPORT=1 HAS_SHA2_SUPPORT=1
else else
unset HAS_MD5_SUPPORT unset HAS_SHA2_SUPPORT
unset RUBY_BUILD_MIRROR_URL unset RUBY_BUILD_MIRROR_URL
fi fi
......
script/mirror
...@@ -11,8 +11,8 @@ test_mirrored() { ...@@ -11,8 +11,8 @@ test_mirrored() {
curl -qsSfIL "$RUBY_BUILD_MIRROR_URL/$1" >/dev/null 2>&1 curl -qsSfIL "$RUBY_BUILD_MIRROR_URL/$1" >/dev/null 2>&1
} }
compute_md5() { compute_sha2() {
local output="$(openssl md5)" local output="$(openssl dgst -sha256)"
echo "${output##* }" | tr '[A-Z]' '[a-z]' echo "${output##* }" | tr '[A-Z]' '[a-z]'
} }
...@@ -26,7 +26,7 @@ download_and_verify() { ...@@ -26,7 +26,7 @@ download_and_verify() {
local file="$2" local file="$2"
local expected="$3" local expected="$3"
download_package "$url" "$file" download_package "$url" "$file"
checksum="$(compute_md5 < "$file")" checksum="$(compute_sha2 < "$file")"
if [ "$checksum" != "$expected" ]; then if [ "$checksum" != "$expected" ]; then
echo "Error: $url doesn't match its checksum $expected" >&2 echo "Error: $url doesn't match its checksum $expected" >&2
return 1 return 1
......
test/cache.bats
...@@ -10,7 +10,7 @@ setup() { ...@@ -10,7 +10,7 @@ setup() {
@test "packages are saved to download cache" { @test "packages are saved to download cache" {
stub md5 true stub shasum true
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
install_fixture definitions/without-checksum install_fixture definitions/without-checksum
...@@ -18,12 +18,12 @@ setup() { ...@@ -18,12 +18,12 @@ setup() {
[ -e "${RUBY_BUILD_CACHE_PATH}/package-1.0.0.tar.gz" ] [ -e "${RUBY_BUILD_CACHE_PATH}/package-1.0.0.tar.gz" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "cached package without checksum" { @test "cached package without checksum" {
stub md5 true stub shasum true
stub curl stub curl
cp "${FIXTURE_ROOT}/package-1.0.0.tar.gz" "$RUBY_BUILD_CACHE_PATH" cp "${FIXTURE_ROOT}/package-1.0.0.tar.gz" "$RUBY_BUILD_CACHE_PATH"
...@@ -33,12 +33,12 @@ setup() { ...@@ -33,12 +33,12 @@ setup() {
[ -e "${RUBY_BUILD_CACHE_PATH}/package-1.0.0.tar.gz" ] [ -e "${RUBY_BUILD_CACHE_PATH}/package-1.0.0.tar.gz" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "cached package with valid checksum" { @test "cached package with valid checksum" {
stub md5 true "echo 83e6d7725e20166024a1eb74cde80677" stub shasum true "echo ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
stub curl stub curl
cp "${FIXTURE_ROOT}/package-1.0.0.tar.gz" "$RUBY_BUILD_CACHE_PATH" cp "${FIXTURE_ROOT}/package-1.0.0.tar.gz" "$RUBY_BUILD_CACHE_PATH"
...@@ -49,15 +49,15 @@ setup() { ...@@ -49,15 +49,15 @@ setup() {
[ -e "${RUBY_BUILD_CACHE_PATH}/package-1.0.0.tar.gz" ] [ -e "${RUBY_BUILD_CACHE_PATH}/package-1.0.0.tar.gz" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "cached package with invalid checksum falls back to mirror and updates cache" { @test "cached package with invalid checksum falls back to mirror and updates cache" {
export RUBY_BUILD_SKIP_MIRROR= export RUBY_BUILD_SKIP_MIRROR=
local checksum="83e6d7725e20166024a1eb74cde80677" local checksum="ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
stub md5 true "echo invalid" "echo $checksum" stub shasum true "echo invalid" "echo $checksum"
stub curl "-*I* : true" \ stub curl "-*I* : true" \
"-q -o * -*S* http://?*/$checksum : cp $FIXTURE_ROOT/package-1.0.0.tar.gz \$3" "-q -o * -*S* http://?*/$checksum : cp $FIXTURE_ROOT/package-1.0.0.tar.gz \$3"
...@@ -70,12 +70,12 @@ setup() { ...@@ -70,12 +70,12 @@ setup() {
diff -q "${RUBY_BUILD_CACHE_PATH}/package-1.0.0.tar.gz" "${FIXTURE_ROOT}/package-1.0.0.tar.gz" diff -q "${RUBY_BUILD_CACHE_PATH}/package-1.0.0.tar.gz" "${FIXTURE_ROOT}/package-1.0.0.tar.gz"
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "nonexistent cache directory is ignored" { @test "nonexistent cache directory is ignored" {
stub md5 true stub shasum true
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
export RUBY_BUILD_CACHE_PATH="${TMP}/nonexistent" export RUBY_BUILD_CACHE_PATH="${TMP}/nonexistent"
...@@ -86,5 +86,5 @@ setup() { ...@@ -86,5 +86,5 @@ setup() {
[ ! -d "$RUBY_BUILD_CACHE_PATH" ] [ ! -d "$RUBY_BUILD_CACHE_PATH" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
test/checksum.bats
...@@ -6,7 +6,7 @@ export RUBY_BUILD_CACHE_PATH= ...@@ -6,7 +6,7 @@ export RUBY_BUILD_CACHE_PATH=
@test "package URL without checksum" { @test "package URL without checksum" {
stub md5 true stub shasum true
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
install_fixture definitions/without-checksum install_fixture definitions/without-checksum
...@@ -14,12 +14,12 @@ export RUBY_BUILD_CACHE_PATH= ...@@ -14,12 +14,12 @@ export RUBY_BUILD_CACHE_PATH=
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "package URL with valid checksum" { @test "package URL with valid checksum" {
stub md5 true "echo 83e6d7725e20166024a1eb74cde80677" stub shasum true "echo ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
install_fixture definitions/with-checksum install_fixture definitions/with-checksum
...@@ -27,12 +27,12 @@ export RUBY_BUILD_CACHE_PATH= ...@@ -27,12 +27,12 @@ export RUBY_BUILD_CACHE_PATH=
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "package URL with invalid checksum" { @test "package URL with invalid checksum" {
stub md5 true "echo 83e6d7725e20166024a1eb74cde80677" stub shasum true "echo ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
install_fixture definitions/with-invalid-checksum install_fixture definitions/with-invalid-checksum
...@@ -40,12 +40,12 @@ export RUBY_BUILD_CACHE_PATH= ...@@ -40,12 +40,12 @@ export RUBY_BUILD_CACHE_PATH=
[ ! -f "${INSTALL_ROOT}/bin/package" ] [ ! -f "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "package URL with checksum but no MD5 support" { @test "package URL with checksum but no shasum support" {
stub md5 false stub shasum false
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
install_fixture definitions/with-checksum install_fixture definitions/with-checksum
...@@ -53,12 +53,12 @@ export RUBY_BUILD_CACHE_PATH= ...@@ -53,12 +53,12 @@ export RUBY_BUILD_CACHE_PATH=
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "package with invalid checksum" { @test "package with invalid checksum" {
stub md5 true "echo invalid" stub shasum true "echo invalid"
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
install_fixture definitions/with-checksum install_fixture definitions/with-checksum
...@@ -66,11 +66,11 @@ export RUBY_BUILD_CACHE_PATH= ...@@ -66,11 +66,11 @@ export RUBY_BUILD_CACHE_PATH=
[ ! -f "${INSTALL_ROOT}/bin/package" ] [ ! -f "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "existing tarball in build location is reused" { @test "existing tarball in build location is reused" {
stub md5 true "echo 83e6d7725e20166024a1eb74cde80677" stub shasum true "echo ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
stub curl false stub curl false
stub wget false stub wget false
...@@ -81,19 +81,19 @@ export RUBY_BUILD_CACHE_PATH= ...@@ -81,19 +81,19 @@ export RUBY_BUILD_CACHE_PATH=
ln -s "${FIXTURE_ROOT}/package-1.0.0.tar.gz" "$RUBY_BUILD_BUILD_PATH" ln -s "${FIXTURE_ROOT}/package-1.0.0.tar.gz" "$RUBY_BUILD_BUILD_PATH"
run_inline_definition <<DEF run_inline_definition <<DEF
install_package "package-1.0.0" "http://example.com/packages/package-1.0.0.tar.gz#83e6d7725e20166024a1eb74cde80677" copy install_package "package-1.0.0" "http://example.com/packages/package-1.0.0.tar.gz#ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5" copy
DEF DEF
assert_success assert_success
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub md5 unstub shasum
} }
@test "existing tarball in build location is discarded if not matching checksum" { @test "existing tarball in build location is discarded if not matching checksum" {
stub md5 true \ stub shasum true \
"echo invalid" \ "echo invalid" \
"echo 83e6d7725e20166024a1eb74cde80677" "echo ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
export -n RUBY_BUILD_CACHE_PATH export -n RUBY_BUILD_CACHE_PATH
...@@ -103,11 +103,11 @@ DEF ...@@ -103,11 +103,11 @@ DEF
touch "${RUBY_BUILD_BUILD_PATH}/package-1.0.0.tar.gz" touch "${RUBY_BUILD_BUILD_PATH}/package-1.0.0.tar.gz"
run_inline_definition <<DEF run_inline_definition <<DEF
install_package "package-1.0.0" "http://example.com/packages/package-1.0.0.tar.gz#83e6d7725e20166024a1eb74cde80677" copy install_package "package-1.0.0" "http://example.com/packages/package-1.0.0.tar.gz#ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5" copy
DEF DEF
assert_success assert_success
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub md5 unstub shasum
} }
test/fixtures/definitions/with-checksum
install_package "package-1.0.0" "http://example.com/packages/package-1.0.0.tar.gz#83e6d7725e20166024a1eb74cde80677" copy install_package "package-1.0.0" "http://example.com/packages/package-1.0.0.tar.gz#ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5" copy
test/mirror.bats
...@@ -7,7 +7,7 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com ...@@ -7,7 +7,7 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com
@test "package URL without checksum bypasses mirror" { @test "package URL without checksum bypasses mirror" {
stub md5 true stub shasum true
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
install_fixture definitions/without-checksum install_fixture definitions/without-checksum
...@@ -16,12 +16,12 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com ...@@ -16,12 +16,12 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "package URL with checksum but no MD5 support bypasses mirror" { @test "package URL with checksum but no shasum support bypasses mirror" {
stub md5 false stub shasum false
stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" stub curl "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
install_fixture definitions/with-checksum install_fixture definitions/with-checksum
...@@ -29,15 +29,15 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com ...@@ -29,15 +29,15 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "package URL with checksum hits mirror first" { @test "package URL with checksum hits mirror first" {
local checksum="83e6d7725e20166024a1eb74cde80677" local checksum="ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
local mirror_url="${RUBY_BUILD_MIRROR_URL}/$checksum" local mirror_url="${RUBY_BUILD_MIRROR_URL}/$checksum"
stub md5 true "echo $checksum" stub shasum true "echo $checksum"
stub curl "-*I* $mirror_url : true" \ stub curl "-*I* $mirror_url : true" \
"-q -o * -*S* $mirror_url : cp $FIXTURE_ROOT/package-1.0.0.tar.gz \$3" "-q -o * -*S* $mirror_url : cp $FIXTURE_ROOT/package-1.0.0.tar.gz \$3"
...@@ -46,15 +46,15 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com ...@@ -46,15 +46,15 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "package is fetched from original URL if mirror download fails" { @test "package is fetched from original URL if mirror download fails" {
local checksum="83e6d7725e20166024a1eb74cde80677" local checksum="ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
local mirror_url="${RUBY_BUILD_MIRROR_URL}/$checksum" local mirror_url="${RUBY_BUILD_MIRROR_URL}/$checksum"
stub md5 true "echo $checksum" stub shasum true "echo $checksum"
stub curl "-*I* $mirror_url : false" \ stub curl "-*I* $mirror_url : false" \
"-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
...@@ -63,15 +63,15 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com ...@@ -63,15 +63,15 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "package is fetched from original URL if mirror download checksum is invalid" { @test "package is fetched from original URL if mirror download checksum is invalid" {
local checksum="83e6d7725e20166024a1eb74cde80677" local checksum="ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
local mirror_url="${RUBY_BUILD_MIRROR_URL}/$checksum" local mirror_url="${RUBY_BUILD_MIRROR_URL}/$checksum"
stub md5 true "echo invalid" "echo $checksum" stub shasum true "echo invalid" "echo $checksum"
stub curl "-*I* $mirror_url : true" \ stub curl "-*I* $mirror_url : true" \
"-q -o * -*S* $mirror_url : cp $FIXTURE_ROOT/package-1.0.0.tar.gz \$3" \ "-q -o * -*S* $mirror_url : cp $FIXTURE_ROOT/package-1.0.0.tar.gz \$3" \
"-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3" "-q -o * -*S* http://example.com/* : cp $FIXTURE_ROOT/\${5##*/} \$3"
...@@ -82,15 +82,15 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com ...@@ -82,15 +82,15 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
@test "default mirror URL" { @test "default mirror URL" {
export RUBY_BUILD_MIRROR_URL= export RUBY_BUILD_MIRROR_URL=
local checksum="83e6d7725e20166024a1eb74cde80677" local checksum="ba988b1bb4250dee0b9dd3d4d722f9c64b2bacfc805d1b6eba7426bda72dd3c5"
stub md5 true "echo $checksum" stub shasum true "echo $checksum"
stub curl "-*I* : true" \ stub curl "-*I* : true" \
"-q -o * -*S* http://?*/$checksum : cp $FIXTURE_ROOT/package-1.0.0.tar.gz \$3" \ "-q -o * -*S* http://?*/$checksum : cp $FIXTURE_ROOT/package-1.0.0.tar.gz \$3" \
...@@ -99,5 +99,5 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com ...@@ -99,5 +99,5 @@ export RUBY_BUILD_MIRROR_URL=http://mirror.example.com
[ -x "${INSTALL_ROOT}/bin/package" ] [ -x "${INSTALL_ROOT}/bin/package" ]
unstub curl unstub curl
unstub md5 unstub shasum
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment