You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by bi...@apache.org on 2018/09/02 00:44:43 UTC
svn commit: r1839865 - in /spamassassin: branches/3.4/ trunk/
trunk/build/mkupdates/
Author: billcole
Date: Sun Sep 2 00:44:43 2018
New Revision: 1839865
URL: http://svn.apache.org/viewvc?rev=1839865&view=rev
Log:
Add SHA512 support to build/mkupdates/* scripts and sa-update
Modified:
spamassassin/branches/3.4/sa-update.raw
spamassassin/trunk/build/mkupdates/hash_existing_tarballs
spamassassin/trunk/build/mkupdates/mkupdate-with-scores
spamassassin/trunk/build/mkupdates/revert-stable-update
spamassassin/trunk/build/mkupdates/run_nightly
spamassassin/trunk/build/mkupdates/update-rules
spamassassin/trunk/build/mkupdates/update-rules-3.3
spamassassin/trunk/sa-update.raw
Modified: spamassassin/branches/3.4/sa-update.raw
URL: http://svn.apache.org/viewvc/spamassassin/branches/3.4/sa-update.raw?rev=1839865&r1=1839864&r2=1839865&view=diff
==============================================================================
--- spamassassin/branches/3.4/sa-update.raw (original)
+++ spamassassin/branches/3.4/sa-update.raw Sun Sep 2 00:44:43 2018
@@ -91,12 +91,12 @@ use Archive::Tar 1.23;
use IO::Zlib 1.04;
use Mail::SpamAssassin::Logger qw(:DEFAULT info log_message);
-our ($have_lwp, $io_socket_module_name, $have_inet4, $have_inet6, $have_sha256);
+our ($have_lwp, $io_socket_module_name, $have_inet4, $have_inet6, $have_sha256, $have_sha512);
BEGIN {
# Deal with optional modules
- eval { require Digest::SHA; import Digest::SHA qw(sha1_hex sha256_hex); 1 } and do { $have_sha256=1 }
+ eval { require Digest::SHA; import Digest::SHA qw(sha1_hex sha256_hex sha512_hex); 1 } and do { $have_sha256=1; $have_sha512=1 }
or do { require Digest::SHA1; import Digest::SHA1 qw(sha1_hex) };
$have_lwp = eval {
@@ -596,13 +596,15 @@ foreach my $channel (@channels) {
}
my $content;
+ my $SHA512;
my $SHA256;
my $SHA1;
my $GPG;
if ($instfile) {
- dbg("channel: using --install files $instfile\{,.sha1,.sha256,.asc\}");
+ dbg("channel: using --install files $instfile\{,.sha1,.sha256,.sha512,.asc\}");
$content = read_install_file($instfile);
+ if ( -s "$instfile.sha512" ) { $SHA512 = read_install_file($instfile.".sha512"); }
if ( -s "$instfile.sha256" ) { $SHA256 = read_install_file($instfile.".sha256"); }
if ( -s "$instfile.sha1" ) { $SHA1 = read_install_file($instfile.".sha1"); }
$GPG = read_install_file($instfile.".asc") if $GPG_ENABLED;
@@ -763,6 +765,17 @@ foreach my $channel (@channels) {
next unless $content;
$preserve_files{$result_fname} = 1;
+ # SHA512 of the archive file
+ $result_fname = http_get("$mirror/$newV.tar.gz.sha512", $UPDDir);
+ if ( -s $result_fname) {
+ $SHA512 = read_content($result_fname, 0);
+ last unless $SHA512;
+ $preserve_files{$result_fname} = 1;
+ } else {
+ undef $SHA512;
+ dbg("channel: No sha512 file available from $mirror");
+ }
+
# SHA256 of the archive file
$result_fname = http_get("$mirror/$newV.tar.gz.sha256", $UPDDir);
if ( -s $result_fname) {
@@ -799,7 +812,7 @@ foreach my $channel (@channels) {
}
- unless ($content && ( $SHA256 || $SHA1 ) && (!$GPG_ENABLED || $GPG)) {
+ unless ($content && ( $SHA512 || $SHA256 || $SHA1 ) && (!$GPG_ENABLED || $GPG)) {
channel_failed("channel: could not find working mirror");
next;
}
@@ -819,6 +832,21 @@ foreach my $channel (@channels) {
next;
}
}
+
+ if ( $SHA512 ) {
+ # Validate the SHA512 signature
+ { local($1);
+ $SHA512 =~ /^([a-fA-F0-9]{64})/;
+ $SHA512 = $1 || 'INVALID';
+ }
+ my $digest = sha512_hex($content);
+ dbg("sha512: verification wanted: $SHA512");
+ dbg("sha512: verification result: $digest");
+ unless ($digest eq $SHA512) {
+ channel_failed("channel: SHA512 verification failed");
+ next;
+ }
+ }
if ( $SHA256 ) {
# Validate the SHA256 signature
Modified: spamassassin/trunk/build/mkupdates/hash_existing_tarballs
URL: http://svn.apache.org/viewvc/spamassassin/trunk/build/mkupdates/hash_existing_tarballs?rev=1839865&r1=1839864&r2=1839865&view=diff
==============================================================================
--- spamassassin/trunk/build/mkupdates/hash_existing_tarballs (original)
+++ spamassassin/trunk/build/mkupdates/hash_existing_tarballs Sun Sep 2 00:44:43 2018
@@ -21,6 +21,9 @@ cd ${UPDDIR:=/var/www/automc.spamassassi
for UPF in +([0-9]).tar.gz
do
[[ -s $UPF.sha256 ]] && continue
- echo "Hashing $UPF" >&2
+ echo "Hashing $UPF with SHA256" >&2
shasum -a 256 $UPF > $UPF.sha256
+ [[ -s $UPF.sha512 ]] && continue
+ echo "Hashing $UPF with SHA512" >&2
+ shasum -a 512 $UPF > $UPF.sha512
done
Modified: spamassassin/trunk/build/mkupdates/mkupdate-with-scores
URL: http://svn.apache.org/viewvc/spamassassin/trunk/build/mkupdates/mkupdate-with-scores?rev=1839865&r1=1839864&r2=1839865&view=diff
==============================================================================
--- spamassassin/trunk/build/mkupdates/mkupdate-with-scores (original)
+++ spamassassin/trunk/build/mkupdates/mkupdate-with-scores Sun Sep 2 00:44:43 2018
@@ -7,7 +7,7 @@
#
# - retrieves the latest gernerated scores for new active.list rules
# - checks out the trunk revision of code that those scores were generated for
-# - generates an update tarball and associated sha1, sha256, and asc files
+# - generates an update tarball and associated sha1, sha256, sha512, and asc files
# - checks out each of the 3.3 stable release tagged versions, builds and
# installs that version (in a tmp dir) and then installs the above generated
# update using sa-update --install to make sure it works with each version
@@ -159,6 +159,7 @@ make_rule_update_from_trunk() {
shasum -a 1 $TMPDIR/${REVISION}.tar.gz > $TMPDIR/${REVISION}.tar.gz.sha1
shasum -a 256 $TMPDIR/${REVISION}.tar.gz > $TMPDIR/${REVISION}.tar.gz.sha256
+ shasum -a 512 $TMPDIR/${REVISION}.tar.gz > $TMPDIR/${REVISION}.tar.gz.sha512
gpg --batch --homedir $KEYDIR -bas $TMPDIR/${REVISION}.tar.gz || exit $?
tar -ztvf $TMPDIR/${REVISION}.tar.gz
@@ -171,6 +172,7 @@ copy_existing_update_for_reversion_testi
copy_update_paranoid "$UPDATEDIR/$REVERT_REVISION.tar.gz.asc" "$TMPDIR/$REVISION.tar.gz.asc" &&
copy_update_paranoid "$UPDATEDIR/$REVERT_REVISION.tar.gz.sha1" "$TMPDIR/$REVISION.tar.gz.sha1" &&
copy_update_paranoid "$UPDATEDIR/$REVERT_REVISION.tar.gz.sha256" "$TMPDIR/$REVISION.tar.gz.sha256"
+ copy_update_paranoid "$UPDATEDIR/$REVERT_REVISION.tar.gz.sha512" "$TMPDIR/$REVISION.tar.gz.sha512"
) || EXIT=6
# copying the update files went wrong exit
@@ -236,7 +238,7 @@ if [ $REVERT_REVISION -eq 0 ]; then
# that we have generated scores for
make_rule_update_from_trunk
else
- if [ ! -f $UPDATEDIR/$REVERT_REVISION.tar.gz -a ! -f $UPDATEDIR/$REVERT_REVISION.tar.gz.asc -a ! -f $UPDATEDIR/$REVERT_REVISION.tar.gz.sha1 -a ! -f $UPDATEDIR/$REVERT_REVISION.tar.gz.sha256 ]; then
+ if [ ! -f $UPDATEDIR/$REVERT_REVISION.tar.gz -a ! -f $UPDATEDIR/$REVERT_REVISION.tar.gz.asc -a ! -f $UPDATEDIR/$REVERT_REVISION.tar.gz.sha1 -a ! -f $UPDATEDIR/$REVERT_REVISION.tar.gz.sha256 -a ! $UPDATEDIR/$REVERT_REVISION.tar.gz.sha512 ]; then
echo "Could not find update files for update revision $REVERT_REVISION, aborting."
exit 8
fi
Modified: spamassassin/trunk/build/mkupdates/revert-stable-update
URL: http://svn.apache.org/viewvc/spamassassin/trunk/build/mkupdates/revert-stable-update?rev=1839865&r1=1839864&r2=1839865&view=diff
==============================================================================
--- spamassassin/trunk/build/mkupdates/revert-stable-update (original)
+++ spamassassin/trunk/build/mkupdates/revert-stable-update Sun Sep 2 00:44:43 2018
@@ -50,7 +50,7 @@ if [ ! $1 ]; then
echo "Usage: ./revert-stable-update 1234567"
fi
-if [ ! -f $UPDATEDIR/$1.tar.gz -a ! -f $UPDATEDIR/$1.tar.gz.asc -a ! -f $UPDATEDIR/$1.tar.gz.sha1 -a ! -f $UPDATEDIR/$1.tar.gz.sha256 ]; then
+if [ ! -f $UPDATEDIR/$1.tar.gz -a ! -f $UPDATEDIR/$1.tar.gz.asc -a ! -f $UPDATEDIR/$1.tar.gz.sha1 -a ! -f $UPDATEDIR/$1.tar.gz.sha256 -a ! -f $UPDATEDIR/$1.tar.gz.sha512 ]; then
echo "Could not find update files for update revision $1"
fi
Modified: spamassassin/trunk/build/mkupdates/run_nightly
URL: http://svn.apache.org/viewvc/spamassassin/trunk/build/mkupdates/run_nightly?rev=1839865&r1=1839864&r2=1839865&view=diff
==============================================================================
--- spamassassin/trunk/build/mkupdates/run_nightly (original)
+++ spamassassin/trunk/build/mkupdates/run_nightly Sun Sep 2 00:44:43 2018
@@ -124,6 +124,7 @@ make_tarball_for_version() {
shasum -a 1 $tmpdir/update.tgz > $tmpdir/update.tgz.sha1 || exit $?
shasum -a 256 $tmpdir/update.tgz > $tmpdir/update.tgz.sha256 || exit $?
+ shasum -a 512 $tmpdir/update.tgz > $tmpdir/update.tgz.sha512 || exit $?
# get SVN revision number.
@@ -179,6 +180,7 @@ make_tarball_for_version() {
mv $tmpdir/update.tgz $UPDDIR/${svnrev}.tar.gz || exit $?
mv $tmpdir/update.tgz.sha1 $UPDDIR/${svnrev}.tar.gz.sha1 || exit $?
mv $tmpdir/update.tgz.sha256 $UPDDIR/${svnrev}.tar.gz.sha256 || exit $?
+ mv $tmpdir/update.tgz.sha512 $UPDDIR/${svnrev}.tar.gz.sha512 || exit $?
mv $tmpdir/update.tgz.asc $UPDDIR/${svnrev}.tar.gz.asc || exit $?
# Give the mirrors time to pull the new files above
Modified: spamassassin/trunk/build/mkupdates/update-rules
URL: http://svn.apache.org/viewvc/spamassassin/trunk/build/mkupdates/update-rules?rev=1839865&r1=1839864&r2=1839865&view=diff
==============================================================================
--- spamassassin/trunk/build/mkupdates/update-rules (original)
+++ spamassassin/trunk/build/mkupdates/update-rules Sun Sep 2 00:44:43 2018
@@ -56,6 +56,7 @@ mv /tmp/$V.tar.gz .
/local/gnupg-1.4.2/bin/gpg --batch --homedir /home/updatesd/key -bas $V.tar.gz
shasum -a 1 $V.tar.gz > $V.tar.gz.sha1
shasum -a 256 $V.tar.gz > $V.tar.gz.sha256
+shasum -a 512 $V.tar.gz > $V.tar.gz.sha512
chmod 0444 $V.tar.*
if [ $VERS = 3.1 ]; then
Modified: spamassassin/trunk/build/mkupdates/update-rules-3.3
URL: http://svn.apache.org/viewvc/spamassassin/trunk/build/mkupdates/update-rules-3.3?rev=1839865&r1=1839864&r2=1839865&view=diff
==============================================================================
--- spamassassin/trunk/build/mkupdates/update-rules-3.3 (original)
+++ spamassassin/trunk/build/mkupdates/update-rules-3.3 Sun Sep 2 00:44:43 2018
@@ -92,6 +92,7 @@ make_tarball_for_version () {
shasum -a 1 $tmpdir/update.tgz > $tmpdir/update.tgz.sha1 || exit $?
shasum -a 256 $tmpdir/update.tgz > $tmpdir/update.tgz.sha256 || exit $?
+ shasum -a 512 $tmpdir/update.tgz > $tmpdir/update.tgz.sha512 || exit $?
# get SVN revision number.
# note: use 'Last Changed Rev' instead of 'Revision'. Because we share
@@ -131,6 +132,7 @@ make_tarball_for_version () {
mv $tmpdir/update.tgz $stagedir/$svnrev.tar.gz || exit $?
mv $tmpdir/update.tgz.sha1 $stagedir/$svnrev.tar.gz.sha1 || exit $?
mv $tmpdir/update.tgz.sha256 $stagedir/$svnrev.tar.gz.sha256 || exit $?
+ mv $tmpdir/update.tgz.sha512 $stagedir/$svnrev.tar.gz.sha512 || exit $?
mv $tmpdir/update.tgz.asc $stagedir/$svnrev.tar.gz.asc || exit $?
chmod 644 $stagedir/$svnrev.*
Modified: spamassassin/trunk/sa-update.raw
URL: http://svn.apache.org/viewvc/spamassassin/trunk/sa-update.raw?rev=1839865&r1=1839864&r2=1839865&view=diff
==============================================================================
--- spamassassin/trunk/sa-update.raw (original)
+++ spamassassin/trunk/sa-update.raw Sun Sep 2 00:44:43 2018
@@ -91,12 +91,12 @@ use Archive::Tar 1.23;
use IO::Zlib 1.04;
use Mail::SpamAssassin::Logger qw(:DEFAULT info log_message);
-our ($have_lwp, $io_socket_module_name, $have_inet4, $have_inet6, $have_sha256);
+our ($have_lwp, $io_socket_module_name, $have_inet4, $have_inet6, $have_sha256, $have_sha512);
BEGIN {
# Deal with optional modules
- eval { require Digest::SHA; import Digest::SHA qw(sha1_hex sha256_hex); 1 } and do { $have_sha256=1 }
+ eval { require Digest::SHA; import Digest::SHA qw(sha1_hex sha256_hex sha512_hex); 1 } and do { $have_sha256=1; $have_sha512=1 }
or do { require Digest::SHA1; import Digest::SHA1 qw(sha1_hex) };
$have_lwp = eval {
@@ -596,13 +596,15 @@ foreach my $channel (@channels) {
}
my $content;
+ my $SHA512;
my $SHA256;
my $SHA1;
my $GPG;
if ($instfile) {
- dbg("channel: using --install files $instfile\{,.sha1,.sha256,.asc\}");
+ dbg("channel: using --install files $instfile\{,.sha1,.sha256,.sha512,.asc\}");
$content = read_install_file($instfile);
+ if ( -s "$instfile.sha512" ) { $SHA512 = read_install_file($instfile.".sha512"); }
if ( -s "$instfile.sha256" ) { $SHA256 = read_install_file($instfile.".sha256"); }
if ( -s "$instfile.sha1" ) { $SHA1 = read_install_file($instfile.".sha1"); }
$GPG = read_install_file($instfile.".asc") if $GPG_ENABLED;
@@ -763,6 +765,17 @@ foreach my $channel (@channels) {
next unless $content;
$preserve_files{$result_fname} = 1;
+ # SHA512 of the archive file
+ $result_fname = http_get("$mirror/$newV.tar.gz.sha512", $UPDDir);
+ if ( -s $result_fname) {
+ $SHA512 = read_content($result_fname, 0);
+ last unless $SHA512;
+ $preserve_files{$result_fname} = 1;
+ } else {
+ undef $SHA512;
+ dbg("channel: No sha512 file available from $mirror");
+ }
+
# SHA256 of the archive file
$result_fname = http_get("$mirror/$newV.tar.gz.sha256", $UPDDir);
if ( -s $result_fname) {
@@ -799,7 +812,7 @@ foreach my $channel (@channels) {
}
- unless ($content && ( $SHA256 || $SHA1 ) && (!$GPG_ENABLED || $GPG)) {
+ unless ($content && ( $SHA512 || $SHA256 || $SHA1 ) && (!$GPG_ENABLED || $GPG)) {
channel_failed("channel: could not find working mirror");
next;
}
@@ -819,6 +832,21 @@ foreach my $channel (@channels) {
next;
}
}
+
+ if ( $SHA512 ) {
+ # Validate the SHA512 signature
+ { local($1);
+ $SHA512 =~ /^([a-fA-F0-9]{64})/;
+ $SHA512 = $1 || 'INVALID';
+ }
+ my $digest = sha512_hex($content);
+ dbg("sha512: verification wanted: $SHA512");
+ dbg("sha512: verification result: $digest");
+ unless ($digest eq $SHA512) {
+ channel_failed("channel: SHA512 verification failed");
+ next;
+ }
+ }
if ( $SHA256 ) {
# Validate the SHA256 signature