diff options
| -rw-r--r-- | contrib/verify-commits/trusted-sha512-root-commit | 2 | ||||
| -rwxr-xr-x | contrib/verify-commits/verify-commits.sh | 13 |
2 files changed, 8 insertions, 7 deletions
diff --git a/contrib/verify-commits/trusted-sha512-root-commit b/contrib/verify-commits/trusted-sha512-root-commit index 189dc215e3..c28f50ff78 100644 --- a/contrib/verify-commits/trusted-sha512-root-commit +++ b/contrib/verify-commits/trusted-sha512-root-commit @@ -1 +1 @@ -b00ba6251f71fa1edaabdf809514e1bc3c67862e +f7ec7cfd38b543ba81ac7bed5b77f9a19739460b diff --git a/contrib/verify-commits/verify-commits.sh b/contrib/verify-commits/verify-commits.sh index cbf59aba94..40c9341445 100755 --- a/contrib/verify-commits/verify-commits.sh +++ b/contrib/verify-commits/verify-commits.sh @@ -47,7 +47,8 @@ IS_SIGNED () { return 1; fi - if [ "$VERIFY_TREE" = 1 ]; then + # We set $4 to 1 on the first call, always verifying the top of the tree + if [ "$VERIFY_TREE" = 1 -o "$4" = "1" ]; then IFS_CACHE="$IFS" IFS=' ' @@ -63,9 +64,10 @@ IS_SIGNED () { IFS="$IFS_CACHE" FILE_HASHES="" - for FILE in $(git ls-tree --full-tree -r --name-only $1 | LANG=C sort); do + for FILE in $(git ls-tree --full-tree -r --name-only $1 | LC_ALL=C sort); do HASH=$(git cat-file blob $1:"$FILE" | sha512sum | { read FIRST OTHER; echo $FIRST; } ) - [ "$FILE_HASHES" != "" ] && FILE_HASHES="$FILE_HASHES"$'\n' + [ "$FILE_HASHES" != "" ] && FILE_HASHES="$FILE_HASHES"' +' FILE_HASHES="$FILE_HASHES$HASH $FILE" done HASH_MATCHES=0 @@ -86,7 +88,7 @@ IS_SIGNED () { local PARENTS PARENTS=$(git show -s --format=format:%P $1) for PARENT in $PARENTS; do - if IS_SIGNED $PARENT $VERIFY_TREE $NO_SHA1; then + if IS_SIGNED $PARENT $VERIFY_TREE $NO_SHA1 0; then return 0; fi break @@ -111,10 +113,9 @@ fi DO_CHECKOUT_TEST=0 if [ x"$2" = "x--tree-checks" ]; then DO_CHECKOUT_TEST=1 - fi -IS_SIGNED "$TEST_COMMIT" "$DO_CHECKOUT_TEST" 1 +IS_SIGNED "$TEST_COMMIT" "$DO_CHECKOUT_TEST" 1 1 RES=$? if [ "$RES" = 1 ]; then if ! "$HAVE_FAILED"; then |