From 9532c86cd0a77d6f6c76c36ebf23682877f1f78c Mon Sep 17 00:00:00 2001 From: Sparrow Date: Sat, 17 Oct 2026 20:14:59 +0530 Subject: [PATCH] scripts: Fix portability issues in asmap-verify (BSD diff and GPG) - Use BSD/POSIX-compatible 'diff -s' instead of GNU-only 'diff --report-identical' so asmap-verify works on macOS/BSD. - Allow overriding the GPG binary via the GPG environment variable (defaulting to 'gpg') to support systems using gpg2 or custom paths. Co-authored-by: hodlinator <172445034+hodlinator@users.noreply.github.com> --- asmap-verify | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/asmap-verify b/asmap-verify index 7d6aedcba8..a8946853f4 100755 --- a/asmap-verify +++ b/asmap-verify @@ -33,7 +33,9 @@ check_tools() { done } -check_tools cat diff gpg basename date +GPG=${GPG:-gpg} + +check_tools cat diff basename date "$GPG" ################ # Usage @@ -112,7 +114,7 @@ verify() { local signer_name signer_name="$(basename "$(dirname "$current_manifest")")" - if ! gpg --quiet --batch \ + if ! "${GPG}" --quiet --batch \ --verify "${current_manifest}.asc" "$current_manifest" 1>&2; then echo "ERR: Failed to verify GPG signature for signer '${signer_name}'" echo " Manifest: '${current_manifest}'" @@ -120,10 +122,10 @@ verify() { echo "" echo "Hint: Either the signature is invalid or the public key is not in" echo " your GPG keyring. You can import it with:" - echo " gpg --import '${builder_keys_dir}/${signer_name}.gpg'" + echo " ${GPG} --import '${builder_keys_dir}/${signer_name}.gpg'" echo "" failure=1 - elif ! diff --report-identical "$compare_base" "$current_manifest" 1>&2; then + elif ! diff -s "$compare_base" "$current_manifest" 1>&2; then echo "ERR: The SHA256SUMS attestation differs from the compare base:" echo " base: '${compare_base}'" echo " current: '${current_manifest}'"