diff --git a/Dockerfile b/Dockerfile index a152d9184..9cbe35463 100644 --- a/Dockerfile +++ b/Dockerfile @@ -29,13 +29,13 @@ FROM alpine as final VOLUME /root/.lnd # Add utilities for quality of life and SSL-related reasons. We also require -# curl and gpg for the signature verification script. +# wget and gpg for the signature verification script. RUN apk --no-cache add \ bash \ jq \ ca-certificates \ gnupg \ - curl + wget # Copy the binaries from the builder image. COPY --from=builder /go/bin/lncli /bin/ diff --git a/scripts/verify-install.sh b/scripts/verify-install.sh index f1b747a71..f1c5aac3d 100755 --- a/scripts/verify-install.sh +++ b/scripts/verify-install.sh @@ -95,14 +95,20 @@ function import_keys() { function verify_signatures() { # Download the JSON of the release itself. That'll contain the release ID we # need for the next call. - RELEASE_JSON=$(curl -L -s -H "$HEADER_JSON" "$RELEASE_URL/$VERSION") + RELEASE_JSON=$(wget -q --header="$HEADER_JSON" -O - "$RELEASE_URL/$VERSION") || { + echo "ERROR: Failed to download release JSON from $RELEASE_URL/$VERSION" + exit 1 + } TAG_NAME=$(echo $RELEASE_JSON | jq -r '.tag_name') RELEASE_ID=$(echo $RELEASE_JSON | jq -r '.id') echo "Release $TAG_NAME found with ID $RELEASE_ID" # Now download the asset list and filter by the manifest and the signatures. - ASSETS=$(curl -L -s -H "$HEADER_GH_JSON" "$API_URL/$RELEASE_ID" | jq -c '.assets[]') + ASSETS=$(wget -q --header="$HEADER_GH_JSON" -O - "$API_URL/$RELEASE_ID" | jq -c '.assets[]') || { + echo "ERROR: Failed to download asset list from $API_URL/$RELEASE_ID" + exit 1 + } MANIFEST=$(echo $ASSETS | jq -r "$MANIFEST_SELECTOR") SIGNATURES=$(echo $ASSETS | jq -r "$SIGNATURE_SELECTOR") @@ -116,11 +122,17 @@ function verify_signatures() { # Download the main "manifest-*.txt" and all "manifest-*.sig" files containing # the detached signatures. echo "Downloading $MANIFEST" - curl -L -s -o "$TEMP_DIR/$MANIFEST" "$RELEASE_URL/download/$VERSION/$MANIFEST" + wget -q -O "$TEMP_DIR/$MANIFEST" "$RELEASE_URL/download/$VERSION/$MANIFEST" || { + echo "ERROR: Failed to download $MANIFEST from $RELEASE_URL/download/$VERSION/$MANIFEST" + exit 1 + } for signature in $SIGNATURES; do echo "Downloading $signature" - curl -L -s -o "$TEMP_DIR/$signature" "$RELEASE_URL/download/$VERSION/$signature" + wget -q -O "$TEMP_DIR/$signature" "$RELEASE_URL/download/$VERSION/$signature" || { + echo "ERROR: Failed to download $signature from $RELEASE_URL/download/$VERSION/$signature" + exit 1 + } done echo "" @@ -267,7 +279,7 @@ shift verify_version "$VERSION" # Make sure we have all tools needed for the verification. -check_command curl +check_command wget check_command jq check_command gpg