Skip to content

verify signature against versioned index.json #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mitchellh merged 1 commit into from
Apr 17, 2026
Merged

verify signature against versioned index.json #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/update.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@ jobs:
- run: "git config user.email mitchellh@users.noreply.github.com"
- run: "git config user.name zig-overlay"
- run: "git add -A"
- run: "git commit -m 'update sources.json' | true"
- run: "git commit -m 'update sources.json' || true"
- run: "git push -u origin main"

13 changes: 9 additions & 4 deletions update
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,12 +13,14 @@ curl -s 'https://ziglang.org/download/index.json' > index.json
VERSION=$(cat index.json | jq -r '.master.version')
echo "Parsing master version: ${VERSION}"

# Verify the signature of the JSON before we parse it
# Download the versioned index.json and its signature, then verify.
# The signature is generated against the versioned file, not the generic one.
curl -s "https://ziglang.org/builds/zig-${VERSION}-index.json" > versioned-index.json
curl -s "https://ziglang.org/builds/zig-${VERSION}-index.json.minisig" > index.json.minisig
minisign -V -P ${PUBLIC_KEY} -x index.json.minisig -m index.json
minisign -V -P ${PUBLIC_KEY} -x index.json.minisig -m versioned-index.json

# Build our new sources.json
cat index.json | jq '
# Build our new sources.json from the verified index
cat versioned-index.json | jq '
["aarch64-linux", "x86_64-linux", "aarch64-macos", "x86_64-macos", "aarch64-windows", "x86_64-windows"] as $targets |
def todarwin(x): x | gsub("macos"; "darwin");
def toentry(vsn; x):
Expand Down Expand Up @@ -57,3 +59,6 @@ cp sources.json sources.old.json

# Recursive merge
jq -s '.[0] * .[1]' sources.old.json sources.new.json > sources.json

# Clean up temp files
rm -f index.json versioned-index.json index.json.minisig sources.old.json sources.new.json