bin/apt-snapshots-expiry

   1 #!/bin/sh
   2
   3 set -eu
   4
   5 FAILURE=no
   6 for dir in config/APT_snapshots.d vagrant/definitions/tails-builder/config/APT_snapshots.d; do
   7     echo "${dir:?}:"
   8     cd "$(git rev-parse --show-toplevel)/${dir:?}"
   9     for ARCHIVE in * ; do
  10         SERIAL="$(cat ${ARCHIVE:?}/serial)"
  11         if [ "${SERIAL:?}" = 'latest' ]; then
  12             EXPIRY='never'
  13             if [ "${ARCHIVE:?}" != 'debian-security' ]; then
  14                 echo "Warning: origin '${ARCHIVE:?}' is using the 'latest' snapshot, which is unexpected" >&2
  15             fi
  16         else
  17             case "${ARCHIVE:?}" in
  18                 'debian-security')
  19                     DIST='buster/updates'
  20                     ;;
  21                 'torproject')
  22                     DIST='buster'
  23                     ;;
  24                 *)
  25                     DIST='stable'
  26                     ;;
  27             esac
  28             EXPIRY="$(curl --silent "https://time-based.snapshots.deb.tails.boum.org/${ARCHIVE:?}/dists/${DIST:?}/snapshots/${SERIAL:?}/Release" | sed -n 's/^Valid-Until:\s\+\(.*\)$/\1/p')"
  29         fi
  30         STATUS="archive '${ARCHIVE:?}' uses snapshot '${SERIAL:?}' which expires on: ${EXPIRY:?}"
  31         if [ "${EXPIRY}" = 'never' ] || \
  32            [ "$(date -d "${EXPIRY}" +%s)" -ge "$(date -d "now + 1 month" +%s)" ]; then
  33             echo "OK:   ${STATUS}"
  34         else
  35             FAILURE=yes
  36             echo "FAIL: ${STATUS}, which is within one month!" >&2
  37         fi
  38     done
  39     echo ---
  40 done
  41
  42 if [ "${FAILURE}" = yes ]; then
  43     exit 1
  44 fi