From 9139c4085913c47af46f4806ac3a9a54876b7b69 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 17 Oct 2026 12:53:16 -1000 Subject: Verify the git tarball against its published sum get-git built whatever the download produced. The tarball is now checked against the SHA-256 kernel.org publishes before it is unpacked, so a corrupt or substituted file stops there. --- Makefile | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 6a91f61..0abecf8 100644 --- a/Makefile +++ b/Makefile @@ -25,9 +25,12 @@ BUILDDIR = build CGIT_ROOT = ../.. # The Git release that get-git fetches when the submodule is not checked out. -# Keep it in step with the commit the submodule is pinned to. +# Keep it in step with the commit the submodule is pinned to, and the sum in +# step with the one kernel.org lists for the tarball in sha256sums.asc. GIT_VERSION = 2.55.0 +GIT_SHA256 = 457fdb04dc8728e007d4688695e6912e6f680727920f2a40bf11eacc17505357 GIT_URL = https://www.kernel.org/pub/software/scm/git/git-$(GIT_VERSION).tar.xz +GIT_TARBALL = git-$(GIT_VERSION).tar.xz # Compiled-in cgit defaults, all overridable through cgit.conf. Every one # carries the CGIT_ prefix except CACHE_ROOT, which is inherited from upstream @@ -129,9 +132,15 @@ clean: cleanall: clean @if test -e $(GITDIR)/Makefile; then $(MAKE) -C $(GITDIR) clean; fi +# The tarball is checked against its sum before anything is unpacked from it. +# An older macOS has no sha256sum, but its shasum reads the same format. get-git: mkdir -p $(dir $(GITDIR)) - curl -L $(GIT_URL) | tar -xJf - && rm -rf $(GITDIR) && mv git-$(GIT_VERSION) $(GITDIR) + curl -fL -o $(GIT_TARBALL) $(GIT_URL) + @if command -v sha256sum >/dev/null; then sum=sha256sum; else sum='shasum -a 256'; fi; \ + echo '$(GIT_SHA256) $(GIT_TARBALL)' | $$sum -c - || { $(RM) $(GIT_TARBALL); exit 1; } + tar -xJf $(GIT_TARBALL) && rm -rf $(GITDIR) && mv git-$(GIT_VERSION) $(GITDIR) + $(RM) $(GIT_TARBALL) tags: @mkdir -p $(BUILDDIR) -- cgit