scripts/gate-hash-verify.sh

1#!/bin/sh

2set -eu

4repo=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)

5scratch=$(mktemp -d /tmp/sigil-channel-hash.XXXXXX)

6trap 'rm -rf "$scratch"' EXIT HUP INT TERM

7git clone --quiet --no-hardlinks "$repo" "$scratch/channel"

9manifest="$scratch/channel/seed/MANIFEST"

10awk 'BEGIN { changed=0 }

11 /^#/ || NF == 0 { print; next }

12 changed == 0 { sub(/^./, "0"); changed=1 }

13 { print }

14' "$manifest" > "$manifest.tampered"

15mv "$manifest.tampered" "$manifest"

17set +e

18SIGIL_BOOTSTRAP_SEED_URL="${SIGIL_BOOTSTRAP_SEED_URL:?set SIGIL_BOOTSTRAP_SEED_URL to the seed archive}" \

19SIGIL_BOOTSTRAP_ZIG_URL="${SIGIL_BOOTSTRAP_ZIG_URL:-}" \

20 "$scratch/channel/bootstrap" >"$scratch/out" 2>&1

21status=$?

22set -e

23[ "$status" -ne 0 ] || { echo "hash gate: bootstrap accepted a tampered hash" >&2; exit 1; }

24grep -q 'REFUSING.*sha256 mismatch' "$scratch/out"

25echo "hash gate: tampered manifest refused"