From d7d1574095206f1fe0ad88959535ea5ba5614b89 Mon Sep 17 00:00:00 2001
From: Oliver Gugger <gugger@gmail.com>
Date: Mon, 27 Sep 2021 11:03:16 +0200
Subject: [PATCH] scripts: verify version in manifest

To make a downgrade attack harder, we also check that the version string
is contained in the manifest, on the same line as the hash.
---
 scripts/verify-install.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/verify-install.sh b/scripts/verify-install.sh
index 27172a35c..98c2db824 100755
--- a/scripts/verify-install.sh
+++ b/scripts/verify-install.sh
@@ -231,7 +231,7 @@ function check_hash() {
     fi
   fi
 
-  if ! grep -q "^$SUM" "$TEMP_DIR/$MANIFEST"; then
+  if ! grep "^$SUM" "$TEMP_DIR/$MANIFEST" | grep -q "$VERSION"; then
     echo "ERROR: Hash $SUM for $2 not found in $MANIFEST: "
     cat "$TEMP_DIR/$MANIFEST"
     echo "  The expected release binaries have been verified with the developer "