Merge pull request #10 from AutumnalAntlers/secure

Exit on archive integrity failures

Author: p-mng

proton-ge-custom-updater.sh

@@ -38,25 +38,28 @@ install() {
         curl -L "$url" --output "$filename"
         # Verify file integrity if sha512sum is availible and a hash can be obtained
         if hash sha512sum && sha512_hash=$(curl -Lf "${url%.tar.gz}.sha512sum" 2>/dev/null); then
-          echo "--> Verfiying file integrity..."
-          if ! sha512sum -c <<< "${sha512_hash%% *}  ${filename}"; then
-            # If the session is interactive, we ask the user whether or not to accept a failed checksum,
-            # but permissively default to continuing if the session is not interactive or no response is given.
-            if [[ -v PS1 ]] || [[ $- = *i* ]]; then
-              while true; do
-                read -p "--> File integrity check failed. Continue? ([Y]/n) "
-                case "$REPLY" in
-                  [yY][eE][sS]|[yY]|'') break ;;
-                  [nN][oO]|[nN]) exit 1 ;;
-                  *) echo "Invalid input..." ;;
-                esac
-              done
-            else
-              echo "--> WARNING: File integrity check failed."
+            echo "--> Verfiying file integrity..."
+            if ! printf '%s' "${sha512_hash%% *}  ${filename}" | sha512sum -c /dev/stdin; then
+                # If stdin is a terminal, we ask whether
+                # or not to accept a failed checksum,
+                # but otherwise exit.
+                if [ -t 0 ]; then
+                    while true; do
+                        printf '%s' "--> File integrity check failed. Continue?  (y/[N]) "
+                        read -r REPLY
+                        case "$REPLY" in
+                            [yY][eE][sS]|[yY]) break ;;
+                            [nN][oO]|[nN]|'') exit 1 ;;
+                            *) echo "Invalid input..." ;;
+                        esac
+                    done
+                else
+                    echo "--> ERROR: File integrity check failed." 1>&2
+                    exit 1
+                fi
             fi
-          fi
-        else
-          echo "--> Skipping file integrity check (hash not found)."
+          else
+              echo "--> Skipping file integrity check (hash not found)."
         fi
         echo "--> Extracting $filename..."
         tar -xf "$filename"