mirror of
https://github.com/Quad4-Software/Reticulum-Go
synced 2026-08-29 23:48:44 -04:00
65 lines
1.8 KiB
Bash
65 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# Install Trivy from the official Aqua Security GitHub release with a pinned SHA256.
|
|
#
|
|
# Usage: setup-trivy.sh <version>
|
|
# version: e.g. 0.69.3
|
|
#
|
|
# Optional overrides:
|
|
# TRIVY_DEB_URL direct .deb URL (default: official GitHub release asset)
|
|
# TRIVY_DEB_SHA256 expected SHA256 of the .deb (default: pinned per version)
|
|
set -eu
|
|
|
|
. "$(dirname "$0")/priv.sh"
|
|
|
|
VER="${1:-}"
|
|
if [ -z "$VER" ] && [ -n "${TRIVY_DEB_URL:-}" ]; then
|
|
VER="custom"
|
|
fi
|
|
if [ -z "$VER" ]; then
|
|
echo "setup-trivy.sh: usage: setup-trivy.sh <version> (e.g. 0.69.3)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
ARCH="$(uname -m)"
|
|
case "$ARCH" in
|
|
x86_64) ARCH="amd64" ;;
|
|
aarch64) ARCH="arm64" ;;
|
|
*) echo "Unsupported architecture for Trivy .deb install: $ARCH" >&2; exit 1 ;;
|
|
esac
|
|
|
|
if [ "$ARCH" != "amd64" ]; then
|
|
echo "setup-trivy.sh: official Trivy .deb packages target amd64; got $ARCH" >&2
|
|
exit 1
|
|
fi
|
|
|
|
DEB="trivy_${VER}_Linux-64bit.deb"
|
|
URL="${TRIVY_DEB_URL:-https://github.com/aquasecurity/trivy/releases/download/v${VER}/${DEB}}"
|
|
|
|
case "$VER" in
|
|
0.69.3) EXPECTED="${TRIVY_DEB_SHA256:-a484057aafde31089cf2558ca0f79a4bc835125a5ee6834183a5bcf0735af358}" ;;
|
|
custom) EXPECTED="${TRIVY_DEB_SHA256:-}" ;;
|
|
*)
|
|
EXPECTED="${TRIVY_DEB_SHA256:-}"
|
|
if [ -z "$EXPECTED" ]; then
|
|
echo "setup-trivy.sh: no pinned SHA256 for Trivy ${VER}; set TRIVY_DEB_SHA256" >&2
|
|
exit 1
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
curl -fsSL -o /tmp/trivy.deb "$URL"
|
|
|
|
if [ -n "$EXPECTED" ]; then
|
|
ACTUAL="$(sha256sum /tmp/trivy.deb | awk '{print $1}')"
|
|
if [ "$ACTUAL" != "$EXPECTED" ]; then
|
|
echo "SHA256 mismatch for Trivy ${DEB}" >&2
|
|
echo "expected: $EXPECTED" >&2
|
|
echo "actual: $ACTUAL" >&2
|
|
rm -f /tmp/trivy.deb
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
run_priv dpkg -i /tmp/trivy.deb 2>/dev/null || run_priv apt-get install -f -y
|
|
rm -f /tmp/trivy.deb
|
|
trivy version
|