danvics/Pulse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(scripts): improve checksum verification robustness against whitespace

Browse source
This commit is contained in:
courtmanr@gmail.com 2025-11-25 08:24:26 +00:00
parent 3acd29c3f3
commit be148d8990
3 changed files with 76 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
scripts/install-container-agent.sh
View file

@ -514,6 +514,56 @@ download_agent() {
exit 1
fi
# Checksum verification
local checksum_url="${download_url}.sha256"
local expected_checksum=""
# Try to fetch checksum
if command -v curl >/dev/null 2>&1; then
local curl_args=(-fsSL "$checksum_url")
if [[ "$PRIMARY_INSECURE" == "true" ]]; then
curl_args=(-k "${curl_args[@]}")
fi
expected_checksum=$(curl "${curl_args[@]}" 2>/dev/null || true)
elif command -v wget >/dev/null 2>&1; then
local wget_args=(-qO- "$checksum_url")
if [[ "$PRIMARY_INSECURE" == "true" ]]; then
wget_args=(--no-check-certificate "${wget_args[@]}")
fi
expected_checksum=$(wget "${wget_args[@]}" 2>/dev/null || true)
fi
if [[ -n "$expected_checksum" ]]; then
log_info "Verifying checksum..."
local actual_checksum=""
if command -v sha256sum >/dev/null 2>&1; then
actual_checksum=$(sha256sum "$tmp" | awk '{print $1}')
elif command -v shasum >/dev/null 2>&1; then
actual_checksum=$(shasum -a 256 "$tmp" | awk '{print $1}')
fi
if [[ -n "$actual_checksum" ]]; then
# Normalize checksums
local clean_expected
clean_expected=$(echo "$expected_checksum" | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
local clean_actual
clean_actual=$(echo "$actual_checksum" | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
if [[ "$clean_expected" != "$clean_actual" ]]; then
rm -f "$tmp"
log_error "Checksum mismatch."
log_error " Expected: '$clean_expected'"
log_error " Actual: '$clean_actual'"
exit 1
fi
log_success "Checksum verified"
else
log_warn "Unable to calculate local checksum (sha256sum/shasum not found). Skipping verification."
fi
else
log_info "No checksum file found at $checksum_url. Skipping verification."
fi
mv "$tmp" "$AGENT_PATH"
chmod 0755 "$AGENT_PATH"
log_success "Agent installed at $AGENT_PATH"

16
scripts/install-docker-agent-v2.sh
View file

@ -810,8 +810,11 @@ fetch_checksum_header() {
fi
local value
value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); print $2}')
value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); sub(/[[:space:]]*$/,"",$2); print $2}')
value=$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')
# Extra trim to be safe
value=$(trim "$value")
if [[ -z "$value" ]]; then
return 1
fi
@ -856,9 +859,16 @@ verify_agent_checksum() {
return 0
fi
if [[ "$FETCHED_CHECKSUM" != "$CALCULATED_CHECKSUM" ]]; then
local clean_fetched
clean_fetched=$(echo "$FETCHED_CHECKSUM" | tr -d '[:space:]')
local clean_calculated
clean_calculated=$(echo "$CALCULATED_CHECKSUM" | tr -d '[:space:]')
if [[ "$clean_fetched" != "$clean_calculated" ]]; then
rm -f "$AGENT_PATH"
log_error "Checksum mismatch. Expected $FETCHED_CHECKSUM but downloaded $CALCULATED_CHECKSUM"
log_error "Checksum mismatch."
log_error " Expected: '$clean_fetched' (from header)"
log_error " Actual: '$clean_calculated' (calculated)"
return 1
fi

16
scripts/install-docker-agent.sh
View file

@ -1679,8 +1679,11 @@ fetch_checksum_header() {
fi
local value
value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); print $2}')
value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); sub(/[[:space:]]*$/,"",$2); print $2}')
value=$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')
# Extra trim to be safe
value=$(trim "$value")
if [[ -z "$value" ]]; then
return 1
fi
@ -1719,9 +1722,16 @@ verify_agent_checksum() {
return 0
fi
if [[ "$(echo "$FETCHED_CHECKSUM" | tr -d '\r\n')" != "$(echo "$CALCULATED_CHECKSUM" | tr -d '\r\n')" ]]; then
local clean_fetched
clean_fetched=$(echo "$FETCHED_CHECKSUM" | tr -d '[:space:]')
local clean_calculated
clean_calculated=$(echo "$CALCULATED_CHECKSUM" | tr -d '[:space:]')
if [[ "$clean_fetched" != "$clean_calculated" ]]; then
rm -f "$AGENT_PATH"
log_error "Checksum mismatch. Expected $FETCHED_CHECKSUM but downloaded $CALCULATED_CHECKSUM"
log_error "Checksum mismatch."
log_error " Expected: '$clean_fetched' (from header)"
log_error " Actual: '$clean_calculated' (calculated)"
return 1
fi