diff --git a/CHANGELOG.md b/CHANGELOG.md --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,10 @@ # Changelog -## 0.3 +## 0.4 (2019-06-03) +- drop version 30 special case +- support gpg verification of checksum file + +## 0.3 (2019-04-16) - run sha256sum check - support fedora Spins diff --git a/Main.hs b/Main.hs --- a/Main.hs +++ b/Main.hs @@ -8,14 +8,12 @@ import qualified Data.ByteString.Char8 as B import Data.Char (isDigit, toLower, toUpper) -import Data.List (intercalate) +import Data.List import Data.Maybe import Data.Semigroup ((<>)) import Data.Text (Text) import qualified Data.Text as T -import Network.HTTP.Client (newManager) -import Network.HTTP.Client.TLS (tlsManagerSettings) import Network.HTTP.Types (decodePathSegments, extractPath) import Network.HTTP.Directory @@ -25,7 +23,7 @@ import Paths_fedora_img_dl (version) -import SimpleCmd (cmd_, error') +import SimpleCmd (cmd_, error', grep_, pipe_, pipeBool, pipeFile_) import SimpleCmdArgs import System.Directory (createDirectoryIfMissing, doesDirectoryExist, @@ -71,31 +69,34 @@ fedoraSpins = [Cinnamon ..] main :: IO () -main = +main = do let pdoc = Just $ P.text "Tool for downloading Fedora iso file images." P.<$$> P.text ("RELEASE = " <> intercalate ", " ["rawhide", "respin", "beta", "or Release version"]) - P.<$$> P.text "EDITION = " <> P.lbrace <> P.align (P.fillCat (P.punctuate P.comma (map (P.text . map toLower . show) [(minBound :: FedoraEdition)..maxBound])) <> P.rbrace) in + P.<$$> P.text "EDITION = " <> P.lbrace <> P.align (P.fillCat (P.punctuate P.comma (map (P.text . map toLower . show) [(minBound :: FedoraEdition)..maxBound])) <> P.rbrace) + P.<$$> P.text "See also ." simpleCmdArgsWithMods (Just version) (fullDesc <> header "Fedora iso downloader" <> progDescDoc pdoc) $ findISO - <$> optional (strOptionWith 'm' "mirror" "HOST" "default https://download.fedoraproject.org") + <$> switchWith 'g' "gpg-keys" "Import Fedora GPG keys for verifying checksum file" <*> switchWith 'n' "dry-run" "Don't actually download anything" + <*> optional (strOptionWith 'm' "mirror" "HOST" "default https://download.fedoraproject.org") <*> strOptionalWith 'a' "arch" "ARCH" "architecture (default x86_64)" "x86_64" <*> optionalWith auto 'e' "edition" "EDITION" "Fedora edition: workstation [default]" Workstation <*> strArg "RELEASE" -findISO :: Maybe String -> Bool -> String -> FedoraEdition -> String -> IO () -findISO mhost dryrun arch edition tgtrel = do - let (mlocn, relpath, mprefix, mrelease) = +findISO :: Bool -> Bool -> Maybe String -> String -> FedoraEdition -> String -> IO () +findISO gpg dryrun mhost arch edition tgtrel = do + (mlocn, relpath, mprefix, mrelease) <- case tgtrel of - "rawhide" -> (Nothing, "development/rawhide", Nothing, Just "Rawhide") + "rawhide" -> return (Nothing, "development/rawhide", Nothing, Just "Rawhide") -- FIXME: version hardcoding for respin, beta, and 30 - "respin" -> (Just "https://dl.fedoraproject.org", "pub/alt/live-respins/", Just ("F29-" <> liveRespin edition <> "-x86_64"), Nothing) - "beta" -> (Nothing ,"releases/test/30_Beta", Nothing, Just "30_Beta") -- FIXME: hardcoding - "30" -> (Nothing, "development/30", Nothing, Just "30") -- FIXME: hardcoding - rel | all isDigit rel -> (Nothing, "releases" rel, Nothing, Just rel) + "respin" -> do + let mlocn = Just "https://dl.fedoraproject.org" + when (isJust mhost && mlocn /= mhost) $ + error' "Cannot specify host for this image" + return (mlocn, "pub/alt/live-respins/", Just ("F29-" <> liveRespin edition <> "-x86_64"), Nothing) + "beta" -> return (Nothing ,"releases/test/30_Beta", Nothing, Just "30_Beta") -- FIXME: hardcoding + rel | all isDigit rel -> return (Nothing, "releases" rel, Nothing, Just rel) _ -> error' "Unknown release" - when (isJust mlocn && isJust mhost && mlocn /= mhost) $ - error' "Cannot specify host for this image" let host = fromMaybe "https://download.fedoraproject.org" $ if isJust mlocn then mlocn else mhost toppath = if null ((decodePathSegments . extractPath) (B.pack host)) @@ -103,7 +104,7 @@ else "" url = if isJust mlocn then host relpath else joinPath [host, toppath, relpath, if edition `elem` fedoraSpins then "Spins" else show edition, arch, editionMedia edition <> "/"] prefix = fromMaybe (intercalate "-" (["Fedora", show edition, editionType edition, arch] <> maybeToList mrelease)) mprefix - (fileurl, remotesize, mchecksum) <- findURL url prefix + (fileurl, remotesize, mchecksum) <- findURL url prefix (tgtrel == "respin") dlDir <- getUserDir "DOWNLOAD" if dryrun then do @@ -118,14 +119,14 @@ fileChecksum mchecksum updateSymlink localfile symlink where - findURL :: String -> String -> IO (String, Maybe Integer, Maybe String) - findURL url prefix = do - mgr <- newManager tlsManagerSettings + findURL :: String -> String -> Bool -> IO (String, Maybe Integer, Maybe String) + findURL url prefix chksumPrefix = do + mgr <- httpManager redirect <- httpRedirect mgr url let finalUrl = maybe url B.unpack redirect hrefs <- httpDirectory mgr finalUrl let mfile = listToMaybe $ filter (T.pack prefix `T.isPrefixOf`) hrefs :: Maybe Text - mchecksum = listToMaybe $ filter (T.pack "CHECKSUM" `T.isSuffixOf`) hrefs + mchecksum = listToMaybe $ filter ((if chksumPrefix then T.isPrefixOf else T.isSuffixOf) (T.pack "CHECKSUM")) hrefs case mfile of Nothing -> error' $ "not found " <> finalUrl @@ -172,13 +173,34 @@ fileChecksum mchecksum = case mchecksum of Nothing -> return () - Just checksum -> do - let local = takeFileName checksum - exists <- doesFileExist local + Just url -> do + let checksum = takeFileName url + exists <- doesFileExist checksum unless exists $ - cmd_ "curl" ["-C", "-", "-s", "-S", "-O", checksum] - putStrLn $ "Running sha256sum on " <> local - cmd_ "sha256sum" ["--check", "--ignore-missing", local] + cmd_ "curl" ["-C", "-", "-s", "-S", "-O", url] + pgp <- grep_ "PGP" checksum + when (gpg && pgp) $ do + havekey <- checkForFedoraKeys + unless havekey $ do + putStrLn "Importing Fedora GPG keys:\n" + -- https://fedoramagazine.org/verify-fedora-iso-file/ + pipe_ ("curl",["-s", "-S", "https://getfedora.org/static/fedora.gpg"]) ("gpg",["--import"]) + putStrLn "" + chkgpg <- if pgp + then checkForFedoraKeys + else return False + let shasum = if "CHECKSUM512" `isPrefixOf` checksum + then "sha512sum" else "sha256sum" + if chkgpg then do + putStrLn $ "Running gpg verify and " <> shasum <> ":" + pipeFile_ checksum ("gpg",["-q"]) (shasum, ["-c", "--ignore-missing"]) + else do + putStrLn $ "Running " <> shasum <> ":" + cmd_ shasum ["-c", "--ignore-missing", checksum] + + checkForFedoraKeys :: IO Bool + checkForFedoraKeys = + pipeBool ("gpg",["--list-keys"]) ("grep", ["-q", " Fedora .*(" ++ tgtrel ++ ").*@fedoraproject.org>"]) editionType :: FedoraEdition -> String editionType Server = "dvd" diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -19,4 +19,6 @@ `fedora-img-dl --edition server --arch aarch64 29` : will bring down the F29 Server iso A symlink to the latest iso is also created: -eg for rawhide it might be `Fedora-Workstation-Live-x86_64-Rawhide-latest.iso`. +eg for rawhide it might be `"Fedora-Workstation-Live-x86_64-Rawhide-latest.iso"`. + +When available it also tries to check the iso checksum and its gpg signature. diff --git a/fedora-img-dl.cabal b/fedora-img-dl.cabal --- a/fedora-img-dl.cabal +++ b/fedora-img-dl.cabal @@ -1,6 +1,6 @@ cabal-version: 1.18 name: fedora-img-dl -version: 0.3 +version: 0.4 synopsis: Fedora image download tool description: Tool to download Fedora iso and image files -- can change to GPL-3.0-or-later with Cabal-2 @@ -10,13 +10,13 @@ bug-reports: https://github.com/juhp/fedora-img-dl/issues author: Jens Petersen maintainer: juhpetersen@gmail.com -copyright: 2019 Jens Petersen +copyright: 2019 Jens Petersen category: Utility build-type: Simple extra-doc-files: README.md , CHANGELOG.md tested-with: GHC == 7.6.3, GHC == 7.8.4, GHC == 7.10.3, GHC == 8.0.2, - GHC == 8.2.2, GHC == 8.4.4, GHC == 8.6.4 + GHC == 8.2.2, GHC == 8.4.4, GHC == 8.6.5 source-repository head type: git @@ -30,12 +30,10 @@ bytestring, directory, filepath, - http-client, - http-client-tls, - http-directory, + http-directory >= 0.1.2, http-types, optparse-applicative, - simple-cmd >= 0.1.4, + simple-cmd >= 0.2.0, simple-cmd-args >= 0.1.1, text, unix,