pyrox.dev
1{ lib
2, writeScript
3, common-updater-scripts
4, bash
5, coreutils
6, curl
7, gnugrep
8, gnupg
9, gnused
10, nix
11}:
12
13let
14 downloadPageUrl = "https://dist.torproject.org";
15
16 # See https://support.torproject.org/little-t-tor/#fetching-the-tor-developers-key
17 signingKeys = [
18 "514102454D0A87DB0767A1EBBE6A0531C18A9179" # Alexander Færøy
19 "B74417EDDF22AC9F9E90F49142E86A2A11F48D36" # David Goulet
20 "2133BC600AB133E1D826D173FE43009C4607B1FB" # Nick Mathewson
21 ];
22in
23
24writeScript "update-tor" ''
25#! ${bash}/bin/bash
26
27set -eu -o pipefail
28
29export PATH=${lib.makeBinPath [
30 common-updater-scripts
31 coreutils
32 curl
33 gnugrep
34 gnupg
35 gnused
36 nix
37]}
38
39srcBase=$(curl -L --list-only -- "${downloadPageUrl}" \
40 | grep -Eo 'tor-([[:digit:]]+\.?)+\.tar\.gz' \
41 | sort -Vu \
42 | tail -n1)
43srcFile=$srcBase
44srcUrl=${downloadPageUrl}/$srcBase
45
46srcName=''${srcBase/.tar.gz/}
47srcVers=(''${srcName//-/ })
48version=''${srcVers[1]}
49
50checksumUrl=$srcUrl.sha256sum
51checksumFile=''${checksumUrl##*/}
52
53sigUrl=$checksumUrl.asc
54sigFile=''${sigUrl##*/}
55
56# upstream does not support byte ranges ...
57[[ -e "$srcFile" ]] || curl -L -o "$srcFile" -- "$srcUrl"
58[[ -e "$checksumFile" ]] || curl -L -o "$checksumFile" -- "$checksumUrl"
59[[ -e "$sigFile" ]] || curl -L -o "$sigFile" -- "$sigUrl"
60
61export GNUPGHOME=$PWD/gnupg
62mkdir -m 700 -p "$GNUPGHOME"
63
64gpg --batch --recv-keys ${lib.concatStringsSep " " (map (x: "'${x}'") signingKeys)}
65gpg --batch --verify "$sigFile" "$checksumFile"
66
67sha256sum -c "$checksumFile"
68
69update-source-version tor "$version" "$(cut -d ' ' "$checksumFile")"
70''