diff options
| author | Oskar <oskar@mullvad.net> | 2025-10-27 08:07:02 +0100 |
|---|---|---|
| committer | Oskar <oskar@mullvad.net> | 2025-10-28 09:32:39 +0100 |
| commit | eae849668022e5a9e478a71746e5b896b9aaac1f (patch) | |
| tree | 3c078834ddd21250cf3c931cb108f42c0cf53102 /desktop/scripts/release | |
| parent | a111c3a303f373a115bc031b57362a30b8e1066f (diff) | |
| download | mullvadvpn-eae849668022e5a9e478a71746e5b896b9aaac1f.tar.xz mullvadvpn-eae849668022e5a9e478a71746e5b896b9aaac1f.zip | |
Verify artifacts using code signing key in repo
Diffstat (limited to 'desktop/scripts/release')
| -rwxr-xr-x | desktop/scripts/release/download-release-artifacts | 9 | ||||
| -rw-r--r-- | desktop/scripts/release/release-config.sh | 4 |
2 files changed, 10 insertions, 3 deletions
diff --git a/desktop/scripts/release/download-release-artifacts b/desktop/scripts/release/download-release-artifacts index aec0fbfe3e..4a83ac672f 100755 --- a/desktop/scripts/release/download-release-artifacts +++ b/desktop/scripts/release/download-release-artifacts @@ -22,10 +22,13 @@ ARTIFACT_DIR=$2 URL_BASE="https://releases.mullvad.net/desktop/releases" +# shellcheck source-path=desktop/scripts/release +source ./release-config.sh + mkdir -p "$ARTIFACT_DIR" -# The signer key file "mullvad-code-signing-key.asc" is expected to exist in the current working directory. -SIGNER_KEY_FILE="./mullvad-code-signing-key.asc" +fingerprint_in_file=$(sq keyring list "$MULLVAD_CODE_SIGNING_KEY_PATH" | awk '{print $2}') +test "$fingerprint_in_file" = "$MULLVAD_CODE_SIGNING_KEY_FINGERPRINT" for ext in .exe _arm64.exe _x64.exe _amd64.deb _arm64.deb _x86_64.rpm _aarch64.rpm .pkg; do pkg_filename="MullvadVPN-${PRODUCT_VERSION}${ext}" @@ -50,7 +53,7 @@ for ext in .exe _arm64.exe _x64.exe _amd64.deb _arm64.deb _x86_64.rpm _aarch64.r echo ">>> Verifying integrity of $pkg_filename" # We prefer sqv for PGP key verification as it a strict and easy-to-use implementation of PGP. # gpg is also not suitable for use in scripting. - if ! sqv --keyring "$SIGNER_KEY_FILE" "$pkg_path.asc" "$pkg_path"; then + if ! sqv --keyring "$MULLVAD_CODE_SIGNING_KEY_PATH" "$pkg_path.asc" "$pkg_path"; then echo "" echo "!!! INTEGRITY CHECKING FAILED !!!" rm "$pkg_path" "$pkg_path.asc" diff --git a/desktop/scripts/release/release-config.sh b/desktop/scripts/release/release-config.sh index f9b0e8d3f9..3b412f35f7 100644 --- a/desktop/scripts/release/release-config.sh +++ b/desktop/scripts/release/release-config.sh @@ -9,3 +9,7 @@ export DATA_DIR="$HOME/.local/share/mullvad-release" # This value is also hardcoded into the `mullvad-release` binary and # has to be in sync with that value export ARTIFACT_DIR="$DATA_DIR/artifacts" + +# Mullvad code signing key and fingerprint +export MULLVAD_CODE_SIGNING_KEY_PATH="../../../ci/keys/1.mullvad_signing.pub" +export MULLVAD_CODE_SIGNING_KEY_FINGERPRINT="A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF" |