build: pin and verify release inputs

1 files changed, 10 insertions, 2 deletions

diff --git a/scripts/check-server b/scripts/check-server
index 9a895a1..6b773a5 100755
--- a/scripts/check-server
+++ b/scripts/check-server
@@ -16,7 +16,7 @@ for file in "$JAR" "$SUM" "$VERSION"; do
     fi
 done
 
-expected=$(awk 'NR == 1 { print $1 }' "$SUM")
+expected=$(cat "$SUM")
 case "$expected" in
     *[!0-9a-f]*|'')
         echo "check-server: invalid SHA-256 in $SUM" >&2
@@ -36,4 +36,12 @@ if [ "$actual" != "$expected" ]; then
     exit 1
 fi
 
-echo "check-server: ok ($(cat "$VERSION"))"
+if ! awk 'BEGIN { ok = 0 }
+        /^[0-9]+([.][0-9]+)*$/ { if (NR == 1) ok = 1; next }
+        { ok = 0 }
+        END { exit !(ok && NR == 1) }' "$VERSION"; then
+    echo "check-server: invalid version in $VERSION" >&2
+    exit 1
+fi
+version=$(cat "$VERSION")
+echo "check-server: ok ($version)"