From ee933acf8482f487edde50803749970a3964cff0 Mon Sep 17 00:00:00 2001 From: Levente Polyak Date: Wed, 12 Apr 2023 20:40:37 +0200 Subject: [PATCH] makepkg: immutable bzr by hashing the checkout content This feature makes bzr VCS build inputs immutable by adding support for pinning a bzr checkout by a hash of its content using the deterministic export functionality `bzr export`. This feature allows to preserve security implications of immutable build inputs using a trusted cryptographic hash function of the content. Signed-off-by: Levente Polyak --- scripts/libmakepkg/source/bzr.sh.in | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/scripts/libmakepkg/source/bzr.sh.in b/scripts/libmakepkg/source/bzr.sh.in index a7f24e4a..2b57e802 100644 --- a/scripts/libmakepkg/source/bzr.sh.in +++ b/scripts/libmakepkg/source/bzr.sh.in @@ -109,3 +109,29 @@ extract_bzr() { popd &>/dev/null } + +calc_checksum_bzr() { + local netfile=$1 integ=$2 ret=0 shellopts dir url fragment fragval sum + + # this function requires pipefail - save current status to restore later + shellopts=$(shopt -p -o pipefail) + shopt -s -o pipefail + + dir=$(get_filepath "$netfile") + url=$(get_url "$netfile") + fragment=$(get_uri_fragment "$url") + + case ${fragment%%=*} in + revision) + fragval=${fragment##*=} + sum=$(bzr export --directory "$dir" --format tar --revision "$fragval" - | "${integ}sum" 2>&1) || ret=1 + sum="${sum%% *}" + ;; + *) + sum="SKIP" + esac + + eval "$shellopts" + printf '%s' "$sum" + return $ret +}