Commit ebed6000 authored by Sam Stephenson's avatar Sam Stephenson
Browse files

Verify MD5 checksums of tarballs downloaded with install_package 

Checksums are optional and specified as anchors on package URLs.
parent a2e94128

bin/ruby-build

+78 −9
Original line number Diff line number Diff line
@@ -127,7 +127,45 @@ make_package() { 
  popd >&4

}



fetch_url() {

compute_md5() {

  if type md5 &>/dev/null; then

    md5 -q

  elif type md5sum &>/dev/null; then

    local output="$(md5sum -b)"

    echo "${output% *}"

  else

    echo "error: please install \`md5sum\` and try again" >&2

    exit 1

  fi

}



verify_checksum() {

  local filename="$1"

  if [ ! -e "$filename" ]; then

    return 1

  fi



  local expected_checksum="$2"

  if [ -z "$expected_checksum" ]; then

    return 0

  fi



  local computed_checksum="$(compute_md5 < "$filename")"

  if [ -z "$computed_checksum" ]; then

    return 1

  fi



  if [ "$expected_checksum" != "$computed_checksum" ]; then

    { echo

      echo "checksum mismatch: ${filename} (file is corrupt)"

      echo "expected $expected_checksum, got $computed_checksum"

      echo

    } >&4

    return 1

  fi

}



retrieve_url() {

  if type curl &>/dev/null; then

    curl -f "$@"

  elif type wget &>/dev/null; then
@@ -141,20 +179,51 @@ fetch_url() { 
fetch_tarball() {

  local package_name="$1"

  local package_url="$2"

  local filename="${package_name}.tar.gz"



  local checksum="${package_url#*\#}"

  if [ -n "$checksum" ]; then

    package_url="${package_url%%#*}"

  fi



  local package_filename="${package_name}.tar.gz"

  symlink_tarball_from_cache "$package_filename" "$checksum" ||

  download_tarball "$package_url" "$package_filename" "$checksum"



  { tar xzvf "$package_filename"

    rm -f "$package_filename"

  } >&4 2>&1

}



symlink_tarball_from_cache() {

  if [ -n "$RUBY_BUILD_CACHE_PATH" ]; then

    filename="${RUBY_BUILD_CACHE_PATH}/${filename}"

    local package_filename="$1"

    local cached_package_filename="${RUBY_BUILD_CACHE_PATH}/$package_filename"

    local checksum="$2"



    if verify_checksum "$cached_package_filename" "$checksum"; then

      ln -s "$cached_package_filename" "$package_filename" >&4 2>&1

      return 0

    fi

  fi

  return 1

}



download_tarball() {

  local package_url="$1"

  local package_filename="$2"

  local checksum="$3"



  if [ ! -e "$filename" ]; then

  echo "Downloading ${package_url}..." >&2

    { fetch_url "$package_url" > "${package_name}.tar.gz"

      [ -z "$RUBY_BUILD_CACHE_PATH" ] || mv "${package_name}.tar.gz" "$filename"

  { retrieve_url "$package_url" > "$package_filename"

    verify_checksum "$package_filename" "$checksum"

  } >&4 2>&1

  fi



  tar xzvf "$filename" >&4 2>&1

  if [ -n "$RUBY_BUILD_CACHE_PATH" ]; then

    local cached_package_filename="${RUBY_BUILD_CACHE_PATH}/$package_filename"

    { mv "$package_filename" "$cached_package_filename"

      ln -s "$cached_package_filename" "$package_filename"

    } >&4 2>&1

  fi

}



fetch_git() {

share/ruby-build/1.8.6-p383

+2 −2
Original line number Diff line number Diff line 
require_gcc

install_package "ruby-1.8.6-p383" "http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p383.tar.gz"

install_package "rubygems-1.3.7" "http://production.cf.rubygems.org/rubygems/rubygems-1.3.7.tgz" ruby
 
install_package "ruby-1.8.6-p383" "http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p383.tar.gz#4f49544d4a4d0d34e9d86c41e853db2e"

install_package "rubygems-1.3.7" "http://production.cf.rubygems.org/rubygems/rubygems-1.3.7.tgz#e85cfadd025ff6ab689375adbf344bbe" ruby

share/ruby-build/1.8.6-p420

+2 −2
Original line number Diff line number Diff line 
require_gcc

install_package "ruby-1.8.6-p420" "http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p420.tar.gz"

install_package "rubygems-1.3.7" "http://production.cf.rubygems.org/rubygems/rubygems-1.3.7.tgz" ruby
 
install_package "ruby-1.8.6-p420" "http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p420.tar.gz#ca1eee44f842e93b5098bc5a2bb9a40b"

install_package "rubygems-1.3.7" "http://production.cf.rubygems.org/rubygems/rubygems-1.3.7.tgz#e85cfadd025ff6ab689375adbf344bbe" ruby

share/ruby-build/1.8.7-p249

+2 −2
Original line number Diff line number Diff line 
require_gcc

install_package "ruby-1.8.7-p249" "http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p249.tar.gz"

install_package "rubygems-1.6.2" "http://production.cf.rubygems.org/rubygems/rubygems-1.6.2.tgz" ruby
 
install_package "ruby-1.8.7-p249" "http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p249.tar.gz#d7db7763cffad279952eb7e9bbfc221c"

install_package "rubygems-1.6.2" "http://production.cf.rubygems.org/rubygems/rubygems-1.6.2.tgz#0c95a9869914ba1a45bf71d3b8048420" ruby

share/ruby-build/1.8.7-p302

+2 −2
Original line number Diff line number Diff line 
require_gcc

install_package "ruby-1.8.7-p302" "http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p302.tar.gz"

install_package "rubygems-1.6.2" "http://production.cf.rubygems.org/rubygems/rubygems-1.6.2.tgz" ruby
 
install_package "ruby-1.8.7-p302" "http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p302.tar.gz#f446550dfde0d8162a6ed8d5a38b3ac2"

install_package "rubygems-1.6.2" "http://production.cf.rubygems.org/rubygems/rubygems-1.6.2.tgz#0c95a9869914ba1a45bf71d3b8048420" ruby