32 lines
754 B
Bash
32 lines
754 B
Bash
|
#!/bin/bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
GNUPGHOME=$(mktemp -d)
|
||
|
|
export GNUPGHOME
|
||
|
|
trap 'rm -rf "$GNUPGHOME"' EXIT
|
||
|
|
|
||
|
|
echo "Fetching metadata..."
|
||
|
|
LATEST_JSON=$(curl -fsSL https://tails.net/install/v2/Tails/amd64/stable/latest.json)
|
||
|
|
|
||
|
|
IMG_URL=$(echo "$LATEST_JSON" | jq -r '.installations[]."installation-paths"[] | select(.type=="img") | .["target-files"][0].url')
|
||
|
|
SIG_URL="${IMG_URL}.sig"
|
||
|
|
|
||
|
|
echo "Image URL: $IMG_URL"
|
||
|
|
curl -fsSLO "$IMG_URL"
|
||
|
|
|
||
|
|
echo "Signature URL: $SIG_URL"
|
||
|
|
curl -fsSLO "$SIG_URL"
|
||
|
|
curl -fsSLO https://tails.net/tails-signing.key
|
||
|
|
|
||
|
|
echo "import signin keys"
|
||
|
|
gpg --import tails-signing.key
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo "Fingerprint of imported key:"
|
||
|
|
gpg --fingerprint
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo "Verifying signature..."
|
||
|
|
TZ=UTC gpg --verify "$(basename "$SIG_URL")" "$(basename "$IMG_URL")"
|
||
|
|
|