This commit is contained in:
@@ -166,6 +166,27 @@ if tar -tvzf "$ARTIFACT" | grep -Eq '^l'; then
|
||||
printf 'Release archive contains a symbolic link\n' >&2
|
||||
exit 1
|
||||
fi
|
||||
RELEASE_METADATA_PATH=$(jq -r '.releaseMetadata // empty' release-manifest.json)
|
||||
if [ -n "$RELEASE_METADATA_PATH" ]; then
|
||||
[ "$RELEASE_METADATA_PATH" = "release-metadata.json" ] \
|
||||
|| { printf 'Release metadata path is invalid\n' >&2; exit 1; }
|
||||
tar -xOf "$ARTIFACT" "./$RELEASE_METADATA_PATH" > "$WORK/release-metadata.json" \
|
||||
|| { printf 'Release archive is missing embedded release metadata\n' >&2; exit 1; }
|
||||
METADATA_VERSION=$(jq -er '.version | strings | select(length > 0)' "$WORK/release-metadata.json") \
|
||||
|| { printf 'Embedded release metadata version is invalid\n' >&2; exit 1; }
|
||||
METADATA_NOTES=$(jq -er '.releaseNotes | strings | select(length > 0 and length <= 4000)' \
|
||||
"$WORK/release-metadata.json") \
|
||||
|| { printf 'Embedded release metadata notes are invalid\n' >&2; exit 1; }
|
||||
METADATA_PUBLISHED_AT=$(jq -er '.publishedAt | strings | select(length > 0)' \
|
||||
"$WORK/release-metadata.json") \
|
||||
|| { printf 'Embedded release metadata publish time is invalid\n' >&2; exit 1; }
|
||||
MANIFEST_PUBLISHED_AT=$(jq -er '.publishedAt | strings | select(length > 0)' release-manifest.json) \
|
||||
|| { printf 'Release manifest publish time is invalid\n' >&2; exit 1; }
|
||||
[ "$METADATA_VERSION" = "$VERSION" ] \
|
||||
&& [ "$METADATA_NOTES" = "$RELEASE_NOTES" ] \
|
||||
&& [ "$METADATA_PUBLISHED_AT" = "$MANIFEST_PUBLISHED_AT" ] \
|
||||
|| { printf 'Embedded release metadata does not match the signed manifest\n' >&2; exit 1; }
|
||||
fi
|
||||
[ "$(tar -xOf "$ARTIFACT" ./VERSION)" = "$VERSION" ] \
|
||||
|| { printf 'Release archive version does not match the manifest\n' >&2; exit 1; }
|
||||
tar -xOf "$ARTIFACT" ./app.jar > "$WORK/app.jar"
|
||||
|
||||
Reference in New Issue
Block a user