scripts: always check certificates

[openwrt/staging/nbd.git] / scripts / download.pl

diff --git a/scripts/download.pl b/scripts/download.pl
index 2d87f47f842bc7d2b9ccc70f43f1f504e1c8c798..ab1801aad5aedd15ca3a2472cff53148e178bbfb 100755 (executable)
--- a/scripts/download.pl
+++ b/scripts/download.pl
@@ -24,6 +24,8 @@ my $scriptdir = dirname($0);
 my @mirrors;
 my $ok;
 
+my $check_certificate = $ENV{DOWNLOAD_CHECK_CERTIFICATE} eq "y";
+
 $url_filename or $url_filename = $filename;
 
 sub localmirrors {
@@ -54,10 +56,8 @@ sub localmirrors {
 
 sub which($) {
        my $prog = shift;
-       my $res = `which $prog`;
+       my $res = `command -v $prog`;
        $res or return undef;
-       $res =~ /^no / and return undef;
-       $res =~ /not found/ and return undef;
        return $res;
 }
 
@@ -65,8 +65,8 @@ sub hash_cmd() {
        my $len = length($file_hash);
        my $cmd;
 
-       $len == 64 and return "mkhash sha256";
-       $len == 32 and return "mkhash md5";
+       $len == 64 and return "$ENV{'MKHASH'} sha256";
+       $len == 32 and return "$ENV{'MKHASH'} md5";
        return undef;
 }
 
@@ -82,8 +82,8 @@ sub download_cmd($) {
        }
 
        return $have_curl
-               ? (qw(curl -f --connect-timeout 20 --retry 5 --location --insecure), shellwords($ENV{CURL_OPTIONS} || ''), $url)
-               : (qw(wget --tries=5 --timeout=20 --no-check-certificate --output-document=-), shellwords($ENV{WGET_OPTIONS} || ''), $url)
+               ? (qw(curl -f --connect-timeout 20 --retry 5 --location), $check_certificate ? '' : '--insecure', shellwords($ENV{CURL_OPTIONS} || ''), $url)
+               : (qw(wget --tries=5 --timeout=20 --output-document=-), $check_certificate ? '' : '--no-check-certificate', shellwords($ENV{WGET_OPTIONS} || ''), $url)
        ;
 }
 
@@ -194,6 +194,12 @@ foreach my $mirror (@ARGV) {
                for (1 .. 5) {
                        push @mirrors, "https://downloads.sourceforge.net/$1";
                }
+       } elsif ($mirror =~ /^\@OPENWRT$/) {
+               # use OpenWrt source server directly
+       } elsif ($mirror =~ /^\@DEBIAN\/(.+)$/) {
+               push @mirrors, "https://ftp.debian.org/debian/$1";
+               push @mirrors, "https://mirror.leaseweb.com/debian/$1";
+               push @mirrors, "https://mirror.netcologne.de/debian/$1";
        } elsif ($mirror =~ /^\@APACHE\/(.+)$/) {
                push @mirrors, "https://mirror.netcologne.de/apache.org/$1";
                push @mirrors, "https://mirror.aarnet.edu.au/pub/apache/$1";
@@ -217,14 +223,14 @@ foreach my $mirror (@ARGV) {
                push @mirrors, "http://mirror.internode.on.net/pub/gnu/$1";
                push @mirrors, "http://mirror.navercorp.com/gnu/$1";
                push @mirrors, "ftp://mirrors.rit.edu/gnu/$1";
-               push @mirrors, "ftp://download.xs4all.nl/pub/gnu/";
+               push @mirrors, "ftp://download.xs4all.nl/pub/gnu/$1";
+               push @mirrors, "https://ftp.gnu.org/gnu/$1";
        } elsif ($mirror =~ /^\@SAVANNAH\/(.+)$/) {
                push @mirrors, "https://mirror.netcologne.de/savannah/$1";
                push @mirrors, "https://mirror.csclub.uwaterloo.ca/nongnu/$1";
                push @mirrors, "http://ftp.acc.umu.se/mirror/gnu.org/savannah/$1";
                push @mirrors, "http://nongnu.uib.no/$1";
                push @mirrors, "http://ftp.igh.cnrs.fr/pub/nongnu/$1";
-               push @mirrors, "http://public.p-knowledge.co.jp/Savannah-nongnu-mirror/$1";
                push @mirrors, "ftp://cdimage.debian.org/mirror/gnu.org/savannah/$1";
                push @mirrors, "ftp://ftp.acc.umu.se/mirror/gnu.org/savannah/$1";
        } elsif ($mirror =~ /^\@KERNEL\/(.+)$/) {
@@ -236,7 +242,6 @@ foreach my $mirror (@ARGV) {
                }
                foreach my $dir (@extra) {
                        push @mirrors, "https://cdn.kernel.org/pub/$dir";
-                       push @mirrors, "https://mirror.rackspace.com/kernel.org/pub/$dir";
                        push @mirrors, "https://download.xs4all.nl/ftp.kernel.org/pub/$dir";
                        push @mirrors, "https://mirrors.mit.edu/kernel/$dir";
                        push @mirrors, "http://ftp.nara.wide.ad.jp/pub/kernel.org/$dir";
@@ -245,6 +250,7 @@ foreach my $mirror (@ARGV) {
                        push @mirrors, "ftp://www.mirrorservice.org/sites/ftp.kernel.org/pub/$dir";
                }
        } elsif ($mirror =~ /^\@GNOME\/(.+)$/) {
+               push @mirrors, "https://download.gnome.org/sources/$1";
                push @mirrors, "https://mirror.csclub.uwaterloo.ca/gnome/sources/$1";
                push @mirrors, "http://ftp.acc.umu.se/pub/GNOME/sources/$1";
                push @mirrors, "http://ftp.kaist.ac.kr/gnome/sources/$1";
@@ -258,7 +264,7 @@ foreach my $mirror (@ARGV) {
        }
 }
 
-#push @mirrors, 'https://mirror1.openwrt.org';
+push @mirrors, 'https://sources.cdn.openwrt.org';
 push @mirrors, 'https://sources.openwrt.org';
 push @mirrors, 'https://mirror2.openwrt.org/sources';
 
@@ -272,11 +278,11 @@ if (-f "$target/$filename") {
                $sum =~ /^(\w+)\s*/ or die "Could not generate file hash\n";
                $sum = $1;
 
+               cleanup();
                exit 0 if $sum eq $file_hash;
 
                die "Hash of the local file $filename does not match (file: $sum, requested: $file_hash) - deleting download.\n";
                unlink "$target/$filename";
-               cleanup();
        };
 }
 
@@ -291,4 +297,3 @@ while (!-f "$target/$filename") {
 }
 
 $SIG{INT} = \&cleanup;
-