다운로드 검증

(
set -euo pipefail
DDS_TRUST=https://www.altifigence.com/downloads/digital-design-studio/trust
curl --fail --silent --show-error "$DDS_TRUST/SHA256SUMS" -o SHA256SUMS
curl --fail --silent --show-error "$DDS_TRUST/SHA256SUMS.sig" -o SHA256SUMS.sig

{ printf '302a300506032b6570032100' | xxd -r -p
  printf '0Km02/+3ttNrM7J6RZ7dTFIPa4TLTMrbrJ0OUOvgjsE=' | base64 -d
} | { echo "-----BEGIN PUBLIC KEY-----"; base64 -w64; echo "-----END PUBLIC KEY-----"; } > dds-download.pem
openssl pkeyutl -verify -pubin -inkey dds-download.pem \
  -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig

grep -E '^[0-9a-f]{64}  altifigence-systemverilog-ide_[0-9]+(\.[0-9]+)+_amd64\.deb$' \
  SHA256SUMS > PACKAGE.SHA256
test "$(wc -l < PACKAGE.SHA256)" -eq 1
PACKAGE=$(cut -d' ' -f3 PACKAGE.SHA256)
VERSION=${PACKAGE#altifigence-systemverilog-ide_}
VERSION=${VERSION%_amd64.deb}
dpkg --compare-versions "$VERSION" ge 1.0.30
sha256sum -c PACKAGE.SHA256
)

(
set -euo pipefail
DDS_TRUST=https://www.altifigence.com/downloads/digital-design-studio/trust
for FILE in altifigence-desktop.pol altifigence-desktop.gpg altifigence-desktop-packages.asc; do
  curl --fail --silent --show-error "$DDS_TRUST/$FILE" -o "$FILE"
done
grep -E '^[0-9a-f]{64}  altifigence-desktop\.(pol|gpg)$' SHA256SUMS > TRUST.SHA256
test "$(wc -l < TRUST.SHA256)" -eq 2
sha256sum -c TRUST.SHA256

FPR=1AD14D70B6EB0DDE1119E705F44BC2496665A843
for KEY in altifigence-desktop.gpg altifigence-desktop-packages.asc; do
  ACTUAL_FPR=$(gpg --batch --show-keys --with-colons "$KEY" \
    | awk -F: '$1 == "fpr" { print $10; exit }')
  test "$ACTUAL_FPR" = "$FPR"
done

VERIFY_DIR=$(mktemp -d)
mkdir -p "$VERIFY_DIR/keyrings/$FPR" "$VERIFY_DIR/policies/$FPR"
cp altifigence-desktop.gpg "$VERIFY_DIR/keyrings/$FPR/"
cp altifigence-desktop.pol "$VERIFY_DIR/policies/$FPR/"
PACKAGE=$(cut -d' ' -f3 PACKAGE.SHA256)
debsig-verify --policies-dir "$VERIFY_DIR/policies" \
  --keyrings-dir "$VERIFY_DIR/keyrings" "$PACKAGE"
)

(
set -euo pipefail
CLI_VERSION=0.1.9
CLI_ARCHIVE="altifigence-cli-$CLI_VERSION-x86_64-unknown-linux-gnu.tar.gz"
CLI_TRUST=https://www.altifigence.com/downloads/cli/trust
EXPECTED_KEY=db9e725f448279fd97d3c6ed7a717b91b87cc66455ae03586d1756a16dee0844
test -f "$CLI_ARCHIVE"
for FILE in CLI-RELEASE-PUBLIC-KEY.pem SHA256SUMS SHA256SUMS.sig \
  RELEASE-CATALOG.json RELEASE-CATALOG.json.sig "$CLI_ARCHIVE.sig"; do
  curl --fail --silent --show-error --proto '=https' "$CLI_TRUST/$FILE" -o "$FILE"
done
ACTUAL_KEY=$(openssl pkey -pubin -in CLI-RELEASE-PUBLIC-KEY.pem \
  -outform DER | sha256sum | cut -d' ' -f1)
test "$ACTUAL_KEY" = "$EXPECTED_KEY"
openssl pkeyutl -verify -pubin -inkey CLI-RELEASE-PUBLIC-KEY.pem \
  -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
awk -v name="$CLI_ARCHIVE" \
  'NF == 2 && $2 == name && length($1) == 64 && $1 !~ /[^0-9a-f]/ {print; n++}
   END {if (n != 1) exit 1}' SHA256SUMS > CLI-ARCHIVE.SHA256
sha256sum -c CLI-ARCHIVE.SHA256
openssl pkeyutl -verify -pubin -inkey CLI-RELEASE-PUBLIC-KEY.pem \
  -rawin -in "$CLI_ARCHIVE" -sigfile "$CLI_ARCHIVE.sig"
openssl pkeyutl -verify -pubin -inkey CLI-RELEASE-PUBLIC-KEY.pem \
  -rawin -in RELEASE-CATALOG.json -sigfile RELEASE-CATALOG.json.sig
jq -e --arg version "$CLI_VERSION" \
  '.schemaVersion == 2 and .releaseOwner == "altifigence-internal/digital-design-studio"
   and .package.version == $version and .package.target == "x86_64-unknown-linux-gnu"
   and .signature.algorithm == "Ed25519"' RELEASE-CATALOG.json
)