pkgs/tools/security/tor/update.nix

   1 {
   2   lib,
   3   writeScript,
   4   common-updater-scripts,
   5   bash,
   6   coreutils,
   7   curl,
   8   gnugrep,
   9   gnupg,
  10   gnused,
  11   nix,
  12 }:
  13
  14 let
  15   downloadPageUrl = "https://dist.torproject.org";
  16
  17   # See https://support.torproject.org/little-t-tor/#fetching-the-tor-developers-key
  18   signingKeys = [
  19     "514102454D0A87DB0767A1EBBE6A0531C18A9179" # Alexander Færøy
  20     "B74417EDDF22AC9F9E90F49142E86A2A11F48D36" # David Goulet
  21     "2133BC600AB133E1D826D173FE43009C4607B1FB" # Nick Mathewson
  22   ];
  23 in
  24
  25 writeScript "update-tor" ''
  26   #! ${bash}/bin/bash
  27
  28   set -eu -o pipefail
  29
  30   export PATH=${
  31     lib.makeBinPath [
  32       common-updater-scripts
  33       coreutils
  34       curl
  35       gnugrep
  36       gnupg
  37       gnused
  38       nix
  39     ]
  40   }
  41
  42   srcBase=$(curl -L --list-only -- "${downloadPageUrl}" \
  43     | grep -Eo 'tor-([[:digit:]]+\.?)+\.tar\.gz' \
  44     | sort -Vu \
  45     | tail -n1)
  46   srcFile=$srcBase
  47   srcUrl=${downloadPageUrl}/$srcBase
  48
  49   srcName=''${srcBase/.tar.gz/}
  50   srcVers=(''${srcName//-/ })
  51   version=''${srcVers[1]}
  52
  53   checksumUrl=$srcUrl.sha256sum
  54   checksumFile=''${checksumUrl##*/}
  55
  56   sigUrl=$checksumUrl.asc
  57   sigFile=''${sigUrl##*/}
  58
  59   # upstream does not support byte ranges ...
  60   [[ -e "$srcFile" ]] || curl -L -o "$srcFile" -- "$srcUrl"
  61   [[ -e "$checksumFile" ]] || curl -L -o "$checksumFile" -- "$checksumUrl"
  62   [[ -e "$sigFile" ]] || curl -L -o "$sigFile" -- "$sigUrl"
  63
  64   export GNUPGHOME=$PWD/gnupg
  65   mkdir -m 700 -p "$GNUPGHOME"
  66
  67   gpg --batch --recv-keys ${lib.concatStringsSep " " (map (x: "'${x}'") signingKeys)}
  68   gpg --batch --verify "$sigFile" "$checksumFile"
  69
  70   sha256sum -c "$checksumFile"
  71
  72   update-source-version tor "$version" "$(cut -d ' ' "$checksumFile")"
  73 ''