71 lines
2.6 KiB
Bash
Executable File
71 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
|
|
work=$(mktemp -d)
|
|
trap 'rm -rf "$work"' EXIT HUP INT TERM
|
|
|
|
assert_no_process_test_seam() {
|
|
artifact=$1
|
|
if LC_ALL=C grep -a -F \
|
|
-e 'proxyctl_process_test' \
|
|
-e 'PROXYCTL_PROCESS_TEST_HOME' \
|
|
"$artifact" >/dev/null
|
|
then
|
|
printf 'release artifact contains the process-test seam: %s\n' "$artifact" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/first"
|
|
VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/second"
|
|
GOFLAGS='-tags=proxyctl_process_test' \
|
|
VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/malicious-goflags"
|
|
printf 'GOFLAGS=-tags=proxyctl_process_test\n' >"$work/malicious-goenv"
|
|
GOENV="$work/malicious-goenv" \
|
|
VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/malicious-goenv-build"
|
|
|
|
for arch in amd64 arm64; do
|
|
binary="proxyctl-linux-$arch"
|
|
test -x "$work/first/$binary"
|
|
cmp "$work/first/$binary" "$work/second/$binary"
|
|
cmp "$work/first/$binary" "$work/malicious-goflags/$binary"
|
|
cmp "$work/first/$binary" "$work/malicious-goenv-build/$binary"
|
|
assert_no_process_test_seam "$work/first/$binary"
|
|
assert_no_process_test_seam "$work/malicious-goflags/$binary"
|
|
assert_no_process_test_seam "$work/malicious-goenv-build/$binary"
|
|
done
|
|
cmp "$work/first/SHA256SUMS" "$work/second/SHA256SUMS"
|
|
cmp "$work/first/SHA256SUMS" "$work/malicious-goflags/SHA256SUMS"
|
|
cmp "$work/first/SHA256SUMS" "$work/malicious-goenv-build/SHA256SUMS"
|
|
|
|
(
|
|
cd "$repo"
|
|
GOENV=off GOFLAGS= CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
|
|
go build -mod=readonly -buildvcs=false -trimpath \
|
|
-tags=proxyctl_process_test -o "$work/known-contaminated" ./cmd/proxyctl
|
|
)
|
|
if assert_no_process_test_seam "$work/known-contaminated"; then
|
|
echo 'release artifact validation accepted a known contaminated binary' >&2
|
|
exit 1
|
|
fi
|
|
printf 'process-test seam scan rejected a known contaminated binary\n'
|
|
|
|
(
|
|
cd "$work/first"
|
|
sha256sum -c SHA256SUMS
|
|
)
|
|
|
|
amd64_format=$(file -b "$work/first/proxyctl-linux-amd64")
|
|
arm64_format=$(file -b "$work/first/proxyctl-linux-arm64")
|
|
printf '%s\n' "$amd64_format" | grep -Eq 'ELF 64-bit.*(x86-64|x86_64)'
|
|
printf '%s\n' "$arm64_format" | grep -Eq 'ELF 64-bit.*(ARM aarch64|aarch64)'
|
|
|
|
# Only execute the binary matching the build host; format checks cover both.
|
|
case $(go env GOARCH) in
|
|
amd64) test "$($work/first/proxyctl-linux-amd64 version --short)" = v1.0.0 ;;
|
|
arm64) test "$($work/first/proxyctl-linux-arm64 version --short)" = v1.0.0 ;;
|
|
esac
|
|
|
|
printf 'amd64: %s\narm64: %s\nrelease automation is reproducible and checksums verify\n' "$amd64_format" "$arm64_format"
|