edde746
09656fa4d3
Pin external actions, images, toolchains, native archives, and tvOS engine artifacts; enforce fail-closed CI checks and keep website privacy disclosures aligned with shipped behavior.
61 lines
1.9 KiB
Bash
Executable File
61 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=build-libmpv.sh
|
|
source "$SCRIPT_DIR/build-libmpv.sh"
|
|
|
|
fail() {
|
|
echo "FAIL: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
assert_absent() {
|
|
[ ! -e "$1" ] || fail "unexpected path remains: $1"
|
|
}
|
|
|
|
temporary="$(mktemp -d)"
|
|
trap 'rm -rf "$temporary"' EXIT
|
|
|
|
fixture="$temporary/source.bin"
|
|
destination="$temporary/download/output.bin"
|
|
printf 'reviewed native input\n' >"$fixture"
|
|
expected="$(sha256_file "$fixture")"
|
|
download_verified "file://$fixture" "$expected" "$destination"
|
|
cmp -s "$fixture" "$destination" || fail "verified download changed bytes"
|
|
|
|
printf 'reviewed native inpuu\n' >"$fixture"
|
|
rm -f "$destination"
|
|
if download_verified "file://$fixture" "$expected" "$destination"; then
|
|
fail "changed archive was accepted"
|
|
fi
|
|
assert_absent "$destination"
|
|
if compgen -G "$destination.tmp.*" >/dev/null; then
|
|
fail "failed download left a temporary file"
|
|
fi
|
|
|
|
repository="$temporary/repository"
|
|
checkout="$temporary/checkout"
|
|
mkdir -p "$repository"
|
|
git -C "$repository" init --quiet
|
|
git -C "$repository" config user.name "Plezy provenance test"
|
|
git -C "$repository" config user.email "provenance-test@invalid.example"
|
|
printf 'first\n' >"$repository/input.txt"
|
|
git -C "$repository" add input.txt
|
|
git -C "$repository" commit --quiet -m first
|
|
git -C "$repository" tag release
|
|
approved_commit="$(git -C "$repository" rev-parse HEAD)"
|
|
checkout_verified_ref "file://$repository" release "$approved_commit" "$checkout"
|
|
[ "$(git -C "$checkout" rev-parse HEAD)" = "$approved_commit" ] ||
|
|
fail "verified checkout selected the wrong commit"
|
|
|
|
printf 'second\n' >"$repository/input.txt"
|
|
git -C "$repository" commit --quiet -am second
|
|
git -C "$repository" tag --force release >/dev/null
|
|
if checkout_verified_ref "file://$repository" release "$approved_commit" "$checkout"; then
|
|
fail "moved tag was accepted"
|
|
fi
|
|
assert_absent "$checkout"
|
|
|
|
echo "Linux native acquisition verification passed"
|