Check Wave Artifacts

gistfile1.txt

#!/bin/sh

wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-bin-0.4.0-alpha.tar.bz2
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-bin-0.4.0-alpha.tar.bz2.asc
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-bin-0.4.0-alpha.tar.bz2.sha
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-bin-0.4.0-alpha.zip
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-bin-0.4.0-alpha.zip.asc
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-bin-0.4.0-alpha.zip.sha
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-src-0.4.0-alpha.tar.bz2
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-src-0.4.0-alpha.tar.bz2.asc
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-src-0.4.0-alpha.tar.bz2.sha
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-src-0.4.0-alpha.zip
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-src-0.4.0-alpha.zip.asc
wget --no-check-certificate https://dist.apache.org/repos/dist/dev/incubator/wave/0.7-incubating/apache-wave-src-0.4.0-alpha.zip.sha

# Ali
# signatur="82540A5A52040D7A983C928DB7424275B76B366B"
# Yuri
signatur = "06FE776669BFEF16E0A10EEC9B82F116FDE34B63"
 
checksum () {
    file1=`openssl $2 $1 | awk -F " " '{print $2}'`
    file2=`cut -d* -f1 $1.$2`
 
    if [ $file1 != $file2 ]
    then
        echo "$2 sums mismatch"
    else
        echo "$2 checksums OK"
    fi
}

verify_signature() {
    local file=$1 out=
    if out=$(gpg --status-fd 1 --verify "$file" 2>/dev/null) &&
       echo "$out" | grep -qs "^\[GNUPG:\] VALIDSIG .* $signatur"; then
        return 0
    else
        echo "$out" >&2
        return 1
    fi
}
 
check_sha () {
    echo "Checking file: $1"
    echo "Using $2 file: $1.$2"
 
    file1=`gpg --print-md SHA512 $1 | cut -d : -f2 | tr -d ' ' | tr -d '\n'`
    file2=`cut -d : -f2 $1.$2 | tr -d ' ' | tr -d '\n' `
 
    echo "File 1: START" $file1 "END"
    echo "File 2: START" $file2 "END"
 
    if [[ $file1 == $file2 ]]
    then
        echo "$2 checksums OK"
    else
        echo "$2 sums mismatch"        
    fi

    echo " "
} 

for checkFile in *.tar.bz2 *.zip; do
    if  [[ $checkFile != "*"* ]] ;
    then
        echo "Checking: $cwd/$checkFile"
        check_sha $checkFile 'sha'

        if verify_signature $checkFile.asc; then
            echo "SIGNATUR VALID"
        else
            echo "SIGNATUR INVALID <---------------"
        fi

        echo "~~~~~~~~~~~~~~~~~~~~~~~"
    fi
done