net-analyzer/wireshark: add support for verify-sig

Bug: https://bugs.gentoo.org/913394 Closes: gentoo#20401 Closes: gentoo#32575 Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Michał Górny <mgorny@gentoo.org>
thesamesam · Sep 3, 2023 · 4ddfd1b · 4ddfd1b
1 parent a6b4684
commit 4ddfd1b
Show file tree

Hide file tree

Showing 3 changed files with 48 additions and 0 deletions.
diff --git a/net-analyzer/wireshark/Manifest b/net-analyzer/wireshark/Manifest
@@ -1,4 +1,5 @@
 DIST wireshark-4.0.6.tar.xz 41583088 BLAKE2B 5c4f3b6e16541afbeb9241d2c66c75da97df3164cbc841f1d5d5ba57fa102d85c8d22275180ce2e4fb72ed73c9fb8e64be1c9b4f337803d85146564bee43ce52 SHA512 651b760d05518a914ffbb2fe1ced84e877ebc40d7b03500586e009609064761bef7810654b1321e08aeea403867450be289227a9e43937e9f777693a8f4c901b
 DIST wireshark-4.0.7.tar.xz 43113752 BLAKE2B 06d4863fe796da8d3b97144a8b24430741ea8f58a8401a56327e0db37e5a7e81e63ab43325c87195a535565af7cb1265e25f8c62600ae69d549da479951bb9a1 SHA512 98f609405f20a3714e7c5e4f806cae5cc842daaf0219bd92d3130d2930758cce244edca4529db59300b5ca1e1e98d1aa632bc5c85c92f26aa2e0c124e691a5ab
 DIST wireshark-4.0.8.tar.xz 43123664 BLAKE2B bda31be809724a39e475489eb5653589310ae679933fac193cbc8bb3924b3ec48a93b5da6d39655fdb9f4a8d717b9cc84fcb357bea275cb457b45783a75ca778 SHA512 f6de0f86bb1eac82f7ed2d98d7f4fe3189107b1f0da441abd9077593f8e624989c33aaf8b4ef4b3c460fe787c64c4b8fdb3168de9f5661802fed6b06d71c5c65
+DIST wireshark-4.1.0-signatures.txt 2706 BLAKE2B bcc55c14a68aead0061041e39114a04531440d98b24e271d731ff6baa0047adac7871f0e089b326d29273bad71f8fa9fa482ebac21ba7635e9a251831d387a34 SHA512 ae0eb7a36f554d27fecd47cb471f3c85b8bd53030a6dc872f74b33a46eee004910a3c095c16d8eed56a7c2e6104084e632580b555f29e77a4b8c04c50b53019a
 DIST wireshark-4.1.0.tar.xz 44601140 BLAKE2B c20a0a917c94554d593986e9058cee7f10c68a0e73a3b8a69e87c40f5932d4f33da1d3ba8ed5177094058bd43ba9942b21a2f3fe6e04a751ffb75e9e9b524627 SHA512 d3253d26d53dbeaa14f7d7dd0956124de3f7fe1d683f2041c6d1420271ba9601248c904a0927160194ca54aa8752526bd5de643d553e55ded8478caa54cd9bb0
diff --git a/net-analyzer/wireshark/wireshark-4.1.0.ebuild b/net-analyzer/wireshark/wireshark-4.1.0.ebuild
@@ -16,7 +16,11 @@ if [[ ${PV} == *9999* ]] ; then
 	EGIT_REPO_URI="https://gitlab.com/wireshark/wireshark"
 	inherit git-r3
 else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/wireshark.asc
+	inherit verify-sig
+
 	SRC_URI="https://www.wireshark.org/download/src/all-versions/${P/_/}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://www.wireshark.org/download/SIGNATURES-${PV}.txt -> ${P}-signatures.txt )"
 	S="${WORKDIR}/${P/_/}"
 
 	# 4.1.x is an experimental release until 4.2
@@ -130,6 +134,10 @@ RDEPEND="
 	selinux? ( sec-policy/selinux-wireshark )
 "
 
+if [[ ${PV} != *9999* ]] ; then
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-wireshark )"
+fi
+
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.6.0-redhat.patch
 )
@@ -147,6 +155,23 @@ pkg_setup() {
 	python-any-r1_pkg_setup
 }
 
+src_unpack() {
+	if [[ ${PV} == *9999* ]] ; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			cd "${DISTDIR}" || die
+			verify-sig_verify_signed_checksums \
+				${P}-signatures.txt \
+				openssl-dgst \
+				${P}.tar.xz
+			cd "${WORKDIR}" || die
+		fi
+
+		default
+	fi
+}
+
 src_configure() {
 	local mycmakeargs
 

diff --git a/net-analyzer/wireshark/wireshark-9999.ebuild b/net-analyzer/wireshark/wireshark-9999.ebuild
@@ -16,7 +16,11 @@ if [[ ${PV} == *9999* ]] ; then
 	EGIT_REPO_URI="https://gitlab.com/wireshark/wireshark"
 	inherit git-r3
 else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/wireshark.asc
+	inherit verify-sig
+
 	SRC_URI="https://www.wireshark.org/download/src/all-versions/${P/_/}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://www.wireshark.org/download/SIGNATURES-${PV}.txt -> ${P}-signatures.txt )"
 	S="${WORKDIR}/${P/_/}"
 
 	# 4.1.x is an experimental release until 4.2
@@ -129,6 +133,9 @@ RDEPEND="
 	gui? ( virtual/freedesktop-icon-theme )
 	selinux? ( sec-policy/selinux-wireshark )
 "
+if [[ ${PV} != *9999* ]] ; then
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-wireshark )"
+fi
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.6.0-redhat.patch
@@ -147,6 +154,21 @@ pkg_setup() {
 	python-any-r1_pkg_setup
 }
 
+src_unpack() {
+	if [[ ${PV} == *9999* ]] ; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			verify-sig_verify_signed_checksums \
+				"${DISTDIR}"/${P}-signatures.txt \
+				sha256 \
+				"${DISTDIR}"/${P}.tar.xz
+		fi
+
+		default
+	fi
+}
+
 src_configure() {
 	local mycmakeargs