tjh.dev
1{
2 lib,
3 writeScript,
4 common-updater-scripts,
5 bash,
6 coreutils,
7 curl,
8 gnugrep,
9 gnupg,
10 gnused,
11 nix,
12}:
13
14let
15 downloadPageUrl = "https://dist.torproject.org";
16
17 # See https://support.torproject.org/little-t-tor/#fetching-the-tor-developers-key
18 signingKeys = [
19 "514102454D0A87DB0767A1EBBE6A0531C18A9179" # Alexander Færøy
20 "B74417EDDF22AC9F9E90F49142E86A2A11F48D36" # David Goulet
21 "2133BC600AB133E1D826D173FE43009C4607B1FB" # Nick Mathewson
22 ];
23in
24
25writeScript "update-tor" ''
26 #! ${bash}/bin/bash
27
28 set -eu -o pipefail
29
30 export PATH=${
31 lib.makeBinPath [
32 common-updater-scripts
33 coreutils
34 curl
35 gnugrep
36 gnupg
37 gnused
38 nix
39 ]
40 }
41
42 srcBase=$(curl -L --list-only -- "${downloadPageUrl}" \
43 | grep -Eo 'tor-([[:digit:]]+\.?)+\.tar\.gz' \
44 | sort -Vu \
45 | tail -n1)
46 srcFile=$srcBase
47 srcUrl=${downloadPageUrl}/$srcBase
48
49 srcName=''${srcBase/.tar.gz/}
50 srcVers=(''${srcName//-/ })
51 version=''${srcVers[1]}
52
53 checksumUrl=$srcUrl.sha256sum
54 checksumFile=''${checksumUrl##*/}
55
56 sigUrl=$checksumUrl.asc
57 sigFile=''${sigUrl##*/}
58
59 # upstream does not support byte ranges ...
60 [[ -e "$srcFile" ]] || curl -L -o "$srcFile" -- "$srcUrl"
61 [[ -e "$checksumFile" ]] || curl -L -o "$checksumFile" -- "$checksumUrl"
62 [[ -e "$sigFile" ]] || curl -L -o "$sigFile" -- "$sigUrl"
63
64 export GNUPGHOME=$PWD/gnupg
65 mkdir -m 700 -p "$GNUPGHOME"
66
67 gpg --batch --recv-keys ${lib.concatStringsSep " " (map (x: "'${x}'") signingKeys)}
68 gpg --batch --verify "$sigFile" "$checksumFile"
69
70 sha256sum -c "$checksumFile"
71
72 update-source-version tor "$version" "$(cut -d ' ' "$checksumFile")"
73''