ci: Check all attestation shasums and verification #5

	name: Attestations

	on:
	push:
	branches:
	- main
	pull_request:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	verify-attestations:
	name: Verify attestation signatures
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Import builder keys
	run: gpg --import builder-keys/*.gpg

	- name: Verify attestations
	run: ./asmap-verify

	verify-shasums:
	name: Verify attested hashes match committed files
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Check committed ASMap files against attested SHA256SUMS
	run: \|
	set -euo pipefail
	shopt -s nullglob

	manifests=( attestations///*/SHA256SUMS )
	if (( ${#manifests[@]} == 0 )); then
	echo "Error: No SHA256SUMS manifests found under attestations/."
	exit 1
	fi

	failure=0
	for manifest in "${manifests[@]}"; do
	year="$(cut -d/ -f2 <<< "$manifest")"
	echo "==> ${manifest}"

	if ! grep -E '\.dat$' "$manifest" \
	\| (cd "$year" && sha256sum --check --strict); then
	failure=1
	fi
	echo ""
	done

	if (( failure )); then
	echo "FAIL: One or more committed ASMap files are missing or do not match their attested hashes."
	exit 1
	fi

	echo "OK: All committed ASMap files match their attested hashes."

Navigation Menu