Check if a go-pear.phar file is an official one

check-go-pear.phar.sh

#!/bin/sh

# This script checks if a go-pear.phar is the same as one of the
# ones released on https://github.com/pear/pearweb_phars
#
# MIT License
# Made by Michele Locati <michele@locati.it> on 2019-01-23

set -o errexit
set -o nounset

IFS=' 
'

FILETOCHECK="${1:-}"

getFileHash () {
    GETFILEHASH_RESULT="$(sha1sum "${1}")"
    printf '%s' "${GETFILEHASH_RESULT%% *}"
}

if test -z "$FILETOCHECK"; then
    echo 'Please specify the path to the go-pear.phar file to be checked.'
    exit 2
fi
if test ! -f "$FILETOCHECK"; then
    printf 'Unable to find the file %s\n' "$FILETOCHECK"
    exit 2
fi
FILETOCHECK_HASH="$(getFileHash "$FILETOCHECK")"

printf 'Creating temporary directory... '
TMPDIR=$(mktemp -d)
cleanup () {
    rm -rf "$TMPDIR" || true
}
trap cleanup EXIT
printf 'done.\n'

printf 'Cloning official git repository https://github.com/pear/pearweb_phars... '
git clone --quiet https://github.com/pear/pearweb_phars.git "$TMPDIR/git"
printf 'done.\n'

printf 'Listing relevant commits... '
COMMIT_LIST=$(git -C "$TMPDIR/git" log --format=tformat:%H go-pear.phar)
printf 'done.\n'

printf 'Checking if %s is in the official repository... ' "$FILETOCHECK"
FOUND_COMMIT=''
for COMMIT in $COMMIT_LIST; do
    git -C "$TMPDIR/git" show "$COMMIT:go-pear.phar" > "$TMPDIR/$COMMIT"
    HASH="$(getFileHash "$TMPDIR/$COMMIT")"
    if test "$FILETOCHECK_HASH" = "$HASH"; then
        FOUND_COMMIT="$COMMIT"
        break
    fi
done

if test -z "$FOUND_COMMIT"; then
    printf 'FAILED!\n%s is not one of the released on https://github.com/pear/pearweb_phars\n' "$FILETOCHECK"
    exit 1
fi

printf 'found.\n%s is the same as the one officially released on %s\nGOOD!\n' "$FILETOCHECK" "$(git -C "$TMPDIR/git" show --no-patch --format=tformat:%ci "$FOUND_COMMIT")"
exit 0

Sample sessions:

$ ./check-go-pear.phar.sh /path/to/good/go-pear.phar
Creating temporary directory... done.
Cloning official git repository https://github.com/pear/pearweb_phars... done.
Listing relevant commits... done.
Checking if /path/to/good/go-pear.phar is in the official repository... found.
/path/to/good/go-pear.phar is the same as the one officially released on 2017-06-27 07:22:57 -0500
GOOD!

$ ./check-go-pear.phar.sh /path/to/bad/go-pear.phar
Creating temporary directory... done.
Cloning official git repository https://github.com/pear/pearweb_phars... done.
Listing relevant commits... done.
Checking if /path/to/bad/go-pear.phar is in the official repository... FAILED!
/path/to/bad/go-pear.phar is not one of the released on https://github.com/pear/pearweb_phars

Thank you for the script. Do you know where go-pear.phar is usually located in a linux system?

Thank you for the script. Do you know where go-pear.phar is usually located in a linux system?

lack of better, you could always do:
sudo find / -name "go-pear.phar"