tools: verify signatures when updating nghttp*

aduh95 · targos · commit 1ca116a6eaa3 · 2025-10-06T16:27:10.000+02:00
PR-URL: #60113 Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
diff --git a/tools/dep_updaters/nghttp.kbx b/tools/dep_updaters/nghttp.kbx
diff --git a/tools/dep_updaters/update-nghttp2.sh b/tools/dep_updaters/update-nghttp2.sh
@@ -42,18 +42,19 @@ cleanup () {
 trap cleanup INT TERM EXIT
 
 NGHTTP2_REF="v$NEW_VERSION"
-NGHTTP2_TARBALL="nghttp2-$NEW_VERSION.tar.gz"
+NGHTTP2_TARBALL="nghttp2-$NEW_VERSION.tar.xz"
 
 cd "$WORKSPACE"
 
 echo "Fetching nghttp2 source archive"
 curl -sL -o "$NGHTTP2_TARBALL" "https://github.com/nghttp2/nghttp2/releases/download/$NGHTTP2_REF/$NGHTTP2_TARBALL"
 
-DEPOSITED_CHECKSUM=$(curl -sL "https://github.com/nghttp2/nghttp2/releases/download/$NGHTTP2_REF/checksums.txt" | grep "$NGHTTP2_TARBALL")
+echo "Verifying PGP signature"
+curl -sL "https://github.com/nghttp2/nghttp2/releases/download/${NGHTTP2_REF}/${NGHTTP2_TARBALL}.asc" \
+| gpgv --keyring "$BASE_DIR/tools/dep_updaters/nghttp.kbx" "$NGHTTP2_TARBALL"
 
-log_and_verify_sha256sum "nghttp2" "$NGHTTP2_TARBALL" "$DEPOSITED_CHECKSUM"
-
-gzip -dc "$NGHTTP2_TARBALL" | tar xf -
+echo "Unpacking archive"
+tar xJf "$NGHTTP2_TARBALL"
 rm "$NGHTTP2_TARBALL"
 mv "nghttp2-$NEW_VERSION" nghttp2
 
diff --git a/tools/dep_updaters/update-nghttp3.sh b/tools/dep_updaters/update-nghttp3.sh
@@ -48,8 +48,12 @@ cd "$WORKSPACE"
 
 echo "Fetching nghttp3 source archive..."
 curl -sL -o "$ARCHIVE_BASENAME.tar.xz" "https://github.com/ngtcp2/nghttp3/releases/download/${NGHTTP3_REF}/${ARCHIVE_BASENAME}.tar.xz"
-SHA256="$(curl -sL "https://github.com/ngtcp2/nghttp3/releases/download/${NGHTTP3_REF}/checksums.txt" | grep 'tar.xz$')"
-log_and_verify_sha256sum "nghttp3" "$ARCHIVE_BASENAME.tar.xz" "$SHA256"
+
+echo "Verifying PGP signature..."
+curl -sL "https://github.com/ngtcp2/nghttp3/releases/download/${NGHTTP3_REF}/${ARCHIVE_BASENAME}.tar.xz.asc" \
+| gpgv --keyring "$BASE_DIR/tools/dep_updaters/nghttp.kbx" - "$ARCHIVE_BASENAME.tar.xz"
+
+echo "Unpacking archive..."
 tar -xJf "$ARCHIVE_BASENAME.tar.xz"
 rm "$ARCHIVE_BASENAME.tar.xz"
 mv "$ARCHIVE_BASENAME" nghttp3
