From 5d59d12d75fb5cbc686e31a3c6c14f1373aeb6a1 Mon Sep 17 00:00:00 2001
From: knoflook <knoflook@disroot.org>
Date: Tue, 26 Oct 2021 11:30:53 +0200
Subject: [PATCH 1/2] refactor(installer): use more precise sed command

---
 scripts/installer/installer | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/installer/installer b/scripts/installer/installer
index 50095437..136932a2 100755
--- a/scripts/installer/installer
+++ b/scripts/installer/installer
@@ -30,8 +30,9 @@ function install_abra_release {
 
   # FIXME: support different architectures
   PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m)
-  sed_command='s/.*"assets":\[\{[^}]*"name":"abra.*_'"$PLATFORM"'"[^}]*"browser_download_url":"([^"]*)".*\].*/\1/p'
-  release_url=$(curl -s $ABRA_RELEASE_URL | sed -En $sed_command)
+  FILENAME="abra_"$ABRA_VERSION"_"$PLATFORM""
+  sed_command_rel='s/.*"assets":\[\{[^]]*"name":"'$FILENAME'"[^}]*"browser_download_url":"([^"]*)".*\].*/\1/p'
+  release_url=$(curl -s $ABRA_RELEASE_URL | sed -En $sed_command_rel)
 
   echo "downloading $ABRA_VERSION $PLATFORM binary release for abra..."
   curl --progress-bar "$release_url" --output "$HOME/.local/bin/abra"
-- 
2.54.0


From 71225d2099b2399c8f20546192b318d90d21610c Mon Sep 17 00:00:00 2001
From: knoflook <knoflook@disroot.org>
Date: Tue, 26 Oct 2021 12:28:56 +0200
Subject: [PATCH 2/2] feat(installer): add hashsum checking

---
 scripts/installer/installer | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/scripts/installer/installer b/scripts/installer/installer
index 136932a2..cec2cd4f 100755
--- a/scripts/installer/installer
+++ b/scripts/installer/installer
@@ -18,6 +18,13 @@ function show_banner {
   echo ""
 }
 
+function print_checksum_error {
+      echo "$(tput setaf 1)ERROR: the checksum of downloaded file doesn't match the checksum in release!!! Either the file was corrupted during download or the file has been changed during transport!$(tput sgr0)"
+      echo "expected checksum: $checksum"
+      echo "checksum of downloaded file: $localsum"
+      echo "abra was NOT installed/upgraded"
+}
+
 function install_abra_release {
   mkdir -p "$HOME/.local/bin"
 
@@ -32,11 +39,27 @@ function install_abra_release {
   PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m)
   FILENAME="abra_"$ABRA_VERSION"_"$PLATFORM""
   sed_command_rel='s/.*"assets":\[\{[^]]*"name":"'$FILENAME'"[^}]*"browser_download_url":"([^"]*)".*\].*/\1/p'
-  release_url=$(curl -s $ABRA_RELEASE_URL | sed -En $sed_command_rel)
+  sed_command_checksums='s/.*"assets":\[\{[^\]*"name":"checksums.txt"[^}]*"browser_download_url":"([^"]*)".*\].*/\1/p'
+
+  json=$(curl -s $ABRA_RELEASE_URL)
+  release_url=$(echo $json | sed -En $sed_command_rel)
+  checksums_url=$(echo $json | sed -En $sed_command_checksums)
+
+  checksums=$(curl -s $checksums_url)
+  checksum=$(echo "$checksums" | grep "$FILENAME" - | sed -En 's/([0-9a-f]{64})\s+'"$FILENAME"'.*/\1/p')
 
   echo "downloading $ABRA_VERSION $PLATFORM binary release for abra..."
-  curl --progress-bar "$release_url" --output "$HOME/.local/bin/abra"
+  curl --progress-bar "$release_url" --output "$HOME/.local/bin/.abra-download"
+  localsum=$(sha256sum $HOME/.local/bin/.abra-download | sed -En 's/([0-9a-f]{64})\s+.*/\1/p')
+  echo "checking if checksums match..."
+  if [[ "$localsum" != "$checksum" ]]; then
+      print_checksum_error
+      exit 1
+  fi
+  echo "$(tput setaf 2)check successful!$(tput sgr0)"
+  mv "$HOME/.local/bin/.abra-download" "$HOME/.local/bin/abra"
   chmod +x "$HOME/.local/bin/abra"
+
   x=$(echo $PATH | grep $HOME/.local/bin)
   if [ $? -ne 0 ]; then
       echo "$(tput setaf 3)WARNING: $HOME/.local/bin/ is not in \$PATH! If you want to run abra by just typing "abra" you should add it to your \$PATH! To do that run:$(tput sgr0)"
-- 
2.54.0