21 lines
923 B
Bash
Executable File
21 lines
923 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch, authenticate, and execute the exact downloaded installer body.
|
|
set -euo pipefail
|
|
url="${1:?usage: verified-installer-fetch.sh <url> <sha256> [-- installer-args...]}"
|
|
expected="${2:?usage: verified-installer-fetch.sh <url> <sha256> [-- installer-args...]}"
|
|
shift 2
|
|
[[ "${1:-}" != -- ]] || shift
|
|
[[ "$expected" =~ ^[0-9a-f]{64}$ ]] || { echo 'installer expected SHA-256 must be 64 lowercase hex characters' >&2; exit 2; }
|
|
tmp="$(mktemp "${TMPDIR:-/tmp}/mosaic-installer-body.XXXXXX")"
|
|
trap 'rm -f "$tmp"' EXIT
|
|
chmod 0600 "$tmp"
|
|
curl -fsSL "$url" -o "$tmp"
|
|
[[ -s "$tmp" ]] || { echo 'installer fetch returned an empty HTTP-success body' >&2; exit 1; }
|
|
actual="$(sha256sum "$tmp" | awk '{print $1}')"
|
|
[[ "$actual" == "$expected" ]] || { echo "installer SHA-256 mismatch (got=$actual expected=$expected)" >&2; exit 1; }
|
|
status=0
|
|
bash "$tmp" "$@" || status=$?
|
|
rm -f "$tmp"
|
|
trap - EXIT
|
|
exit "$status"
|