build: pin and verify release inputs

1 files changed, 21 insertions, 3 deletions

diff --git a/scripts/check-wrapper b/scripts/check-wrapper
index 3997bed..c56b935 100755
--- a/scripts/check-wrapper
+++ b/scripts/check-wrapper
@@ -18,7 +18,25 @@ if [ ! -f "$EXPECTED_FILE" ]; then
     exit 1
 fi
 
-# sha256sum reads its first column from the .sha256 sidecar; the second
-# column ('gradle-wrapper.jar') is informational.
-( cd "$(dirname "$WRAPPER")" && sha256sum -c "$(basename "$EXPECTED_FILE")" >/dev/null )
+line=$(cat "$EXPECTED_FILE")
+expected=${line%  gradle-wrapper.jar}
+if [ "$line" != "$expected  gradle-wrapper.jar" ]; then
+    echo "check-wrapper: malformed $EXPECTED_FILE" >&2
+    exit 1
+fi
+case "$expected" in
+    *[!0-9a-f]*|'')
+        echo "check-wrapper: invalid SHA-256 in $EXPECTED_FILE" >&2
+        exit 1
+        ;;
+esac
+if [ "${#expected}" -ne 64 ]; then
+    echo "check-wrapper: invalid SHA-256 length in $EXPECTED_FILE" >&2
+    exit 1
+fi
+actual=$(sha256sum "$WRAPPER" | awk '{ print $1 }')
+if [ "$actual" != "$expected" ]; then
+    echo "check-wrapper: gradle-wrapper.jar checksum mismatch" >&2
+    exit 1
+fi
 echo "check-wrapper: ok"