30 lines
1.5 KiB
JavaScript
30 lines
1.5 KiB
JavaScript
import fs from 'node:fs/promises';
|
|
import path from 'node:path';
|
|
import {fileURLToPath} from 'node:url';
|
|
import {createHash} from 'node:crypto';
|
|
|
|
const here = path.dirname(fileURLToPath(import.meta.url));
|
|
const target = path.resolve(process.argv[2] || 'output/security-go-build');
|
|
await fs.mkdir(target, {recursive:true});
|
|
const pins = JSON.parse(await fs.readFile(path.join(here, 'go-sources.json')));
|
|
const checks = [];
|
|
for (const pin of pins) {
|
|
const file = path.join(target, pin.name + '.tar.gz');
|
|
let bytes;
|
|
try { bytes = await fs.readFile(file); } catch (error) {
|
|
if (error.code !== 'ENOENT') throw error;
|
|
const response = await fetch(`https://codeload.github.com/${pin.repo}/tar.gz/${pin.commit}`);
|
|
if (!response.ok) throw Error(`Source download: ${pin.name} HTTP ${response.status}`);
|
|
bytes = Buffer.from(await response.arrayBuffer());
|
|
if (createHash('sha256').update(bytes).digest('hex') !== pin.sha256) throw Error(`Source checksum: ${pin.name}`);
|
|
await fs.writeFile(file, bytes, {flag:'wx'});
|
|
}
|
|
if (createHash('sha256').update(bytes).digest('hex') !== pin.sha256) throw Error(`Source checksum: ${pin.name}`);
|
|
checks.push(`${pin.sha256} ${pin.name}.tar.gz`);
|
|
}
|
|
await fs.writeFile(path.join(target, 'sources.sha256'), checks.join('\n') + '\n');
|
|
for (const [from,to] of [['go-rebuild.Dockerfile','Dockerfile'],['tls-probe.go','tls-probe.go']]) {
|
|
await fs.copyFile(path.join(here, from), path.join(target,to));
|
|
}
|
|
console.log(JSON.stringify({target, sourcesVerified:pins.length, go:'1.26.10'}));
|