Verify checksum of s3deploy tool (influxdata#2596)

ShreyashKanhed · May 25, 2021 · c62b830 · c62b830
1 parent 10f00e1
commit c62b830
Showing 1 changed file with 15 additions and 6 deletions.
diff --git a/deploy/ci-install-s3deploy.sh b/deploy/ci-install-s3deploy.sh
@@ -1,11 +1,20 @@
-S3DEPLOY_DOWNLOAD=s3deploy_${S3DEPLOY_VERSION}_Linux-64bit.tar.gz
-
 set -x
 set -e
 
+S3DEPLOY_DOWNLOAD=s3deploy_${S3DEPLOY_VERSION}_Linux-64bit.tar.gz
+S3DEPLOY_HASH=$(
+    # Download the checksums file from https://github.com/bep/s3deploy/releases
+    # and grep for the Linux-64bit.tar.gz hash.
+    curl -sL https://github.com/bep/s3deploy/releases/download/v${S3DEPLOY_VERSION}/s3deploy_${S3DEPLOY_VERSION}_checksums.txt \
+        | grep "Linux-64bit.tar.gz" | cut -f 1 -d" " | tr -d "\n"
+)
+
 # Install s3deploy if not already cached or upgrade an old version.
 if [ ! -e $HOME/bin/s3deploy ] || ! [[ `$HOME/bin/s3deploy -V` =~ ${S3DEPLOY_VERSION} ]]; then
-  wget https://github.com/bep/s3deploy/releases/download/v${S3DEPLOY_VERSION}/${S3DEPLOY_DOWNLOAD}
-  tar xvzf ${S3DEPLOY_DOWNLOAD} s3deploy
-  mv s3deploy $HOME/bin/s3deploy
-fi
+    # Download and verify checksum
+    wget https://github.com/bep/s3deploy/releases/download/v${S3DEPLOY_VERSION}/${S3DEPLOY_DOWNLOAD}
+    echo "$S3DEPLOY_HASH $S3DEPLOY_DOWNLOAD" | sha256sum --check -
+
+    tar xvzf ${S3DEPLOY_DOWNLOAD} s3deploy
+    mv s3deploy $HOME/bin/s3deploy
+fi