@@ -15,14 +15,11 @@ with lib;
1515let
1616 downloadPageUrl = "https://dist.torproject.org";
1717
18− # See https://www.torproject.org/docs/signing-keys.html
18+ # See https://support.torproject.org/little-t-tor/#fetching-the-tor-developers-key
1919 signingKeys = [
20− # Roger Dingledine
21− "B117 2656 DFF9 83C3 042B C699 EB5A 896A 2898 8BF5"
22− "F65C E37F 04BA 5B36 0AE6 EE17 C218 5258 19F7 8451"
23− # Nick Mathewson
24− "2133 BC60 0AB1 33E1 D826 D173 FE43 009C 4607 B1FB"
25− "B117 2656 DFF9 83C3 042B C699 EB5A 896A 2898 8BF5"
20+ "514102454D0A87DB0767A1EBBE6A0531C18A9179" # Alexander Færøy
21+ "B74417EDDF22AC9F9E90F49142E86A2A11F48D36" # David Goulet
22+ "2133BC600AB133E1D826D173FE43009C4607B1FB" # Nick Mathewson
2623 ];
2724in
2825
@@ -52,20 +49,24 @@ srcName=''${srcBase/.tar.gz/}
5249srcVers=(''${srcName//-/ })
5350version=''${srcVers[1]}
5451
55−sigUrl=$srcUrl.asc
52+checksumUrl=$srcUrl.sha256sum
53+checksumFile=''${checksumUrl##*/}
54+
55+sigUrl=$checksumUrl.asc
5656sigFile=''${sigUrl##*/}
5757
5858# upstream does not support byte ranges ...
5959[[ -e "$srcFile" ]] || curl -L -o "$srcFile" -- "$srcUrl"
60+[[ -e "$checksumFile" ]] || curl -L -o "$checksumFile" -- "$checksumUrl"
6061[[ -e "$sigFile" ]] || curl -L -o "$sigFile" -- "$sigUrl"
6162
6263export GNUPGHOME=$PWD/gnupg
6364mkdir -m 700 -p "$GNUPGHOME"
6465
6566gpg --batch --recv-keys ${concatStringsSep " " (map (x: "'${x}'") signingKeys)}
66−gpg --batch --verify "$sigFile" "$srcFile"
67+gpg --batch --verify "$sigFile" "$checksumFile"
6768
68−sha256=$(nix-hash --type sha256 --flat --base32 "$srcFile")
69+sha256sum -c "$checksumFile"
6970
70−update-source-version tor "$version" "$sha256"
71+update-source-version tor "$version" "$(cut -d ' ' "$checksumFile")"
7172''