106 lines
4.0 KiB
Bash
Executable File
106 lines
4.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# script/vendor-blocklist: refresh the vendored phishing blocklist at
|
|
# src/shared/phishingBlocklist.json from its upstream source. Our own extension
|
|
# to scripts-to-rule-them-all.
|
|
#
|
|
# This is build-time repo tooling and is not shipped. It is the one place in
|
|
# this repo that names the upstream project, because a source reference that
|
|
# does not say what the source is cannot be verified by anyone; the artifact it
|
|
# writes carries no names at all (see src/shared/domainHash.js).
|
|
# script/check-censored reads the name back out of this file rather than
|
|
# repeating it, so it stays defined exactly once.
|
|
#
|
|
# Run it deliberately, not on every build: the output is committed, and the
|
|
# extension does no runtime fetching, so the shipped list is exactly as fresh as
|
|
# the last time someone ran this and landed the result. Re-run it, land the
|
|
# diff, cut a release; that is the whole refresh path.
|
|
#
|
|
# Pinned by content hash, twice over, as REPO_POLICIES.md requires. The commit
|
|
# below is an immutable ref — the upstream default branch moves several times a
|
|
# day and cannot be pinned — and UPSTREAM_SHA256 is the sha256 of the bytes that
|
|
# commit serves. A mismatch is a hard failure: a vendoring step that accepts
|
|
# whatever it is handed is a supply-chain hole, and this one feeds a security
|
|
# warning shown to users.
|
|
#
|
|
# To move the pin: pick the new commit, run this with the new UPSTREAM_COMMIT
|
|
# and an UPSTREAM_SHA256 you have not yet updated, and it will print the hash it
|
|
# actually got. Verify that hash against the source independently before
|
|
# recording it. Never copy the "actual" line in on trust.
|
|
set -eu
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
|
|
|
# Upstream, pinned 2026-08-17.
|
|
UPSTREAM_ORG="MetaMask"
|
|
UPSTREAM_REPO="eth-phishing-detect"
|
|
UPSTREAM_COMMIT="6dddf74a87da3e1a0841f7ae0d1cb31aaf2c05db"
|
|
UPSTREAM_FILE="src/config.json"
|
|
UPSTREAM_SHA256="166d5b3504e8f4ed52eae37d3dd20c1a56efa0502bfb3dc957044ff8b5f1283f"
|
|
|
|
OUTPUT="src/shared/phishingBlocklist.json"
|
|
|
|
WORK=""
|
|
|
|
cleanup() {
|
|
[ -z "$WORK" ] || rm -rf "$WORK"
|
|
}
|
|
trap cleanup EXIT INT TERM
|
|
|
|
fail() {
|
|
echo "vendor-blocklist: $*" >&2
|
|
exit 1
|
|
}
|
|
|
|
sha256_of() {
|
|
if command -v sha256sum >/dev/null 2>&1; then
|
|
sha256sum "$1" | cut -d' ' -f1
|
|
elif command -v shasum >/dev/null 2>&1; then
|
|
shasum -a 256 "$1" | cut -d' ' -f1
|
|
else
|
|
fail "neither sha256sum nor shasum is available, so the fetched
|
|
source cannot be verified. Refusing to vendor unverified content."
|
|
fi
|
|
}
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
|
|
command -v curl >/dev/null 2>&1 ||
|
|
fail "curl is required to fetch the upstream list"
|
|
command -v node >/dev/null 2>&1 ||
|
|
fail "node is required to build the artifact; run script/bootstrap"
|
|
|
|
WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-vendor-blocklist.XXXXXX")" ||
|
|
fail "could not create a working directory"
|
|
|
|
url="https://raw.githubusercontent.com/$UPSTREAM_ORG/$UPSTREAM_REPO/$UPSTREAM_COMMIT/$UPSTREAM_FILE"
|
|
echo "Fetching $url"
|
|
curl -fsSL --proto '=https' --tlsv1.2 -o "$WORK/source.json" "$url" ||
|
|
fail "the fetch failed, so nothing was vendored"
|
|
|
|
actual="$(sha256_of "$WORK/source.json")"
|
|
if [ "$actual" != "$UPSTREAM_SHA256" ]; then
|
|
fail "sha256 mismatch on the fetched source.
|
|
expected: $UPSTREAM_SHA256
|
|
actual: $actual
|
|
The pinned commit is immutable, so the same commit serving different bytes
|
|
means the content was substituted somewhere between upstream and here.
|
|
Nothing was written. Do not update the expectation to match unless you have
|
|
verified the new bytes independently."
|
|
fi
|
|
echo "Verified sha256 $actual"
|
|
|
|
node script/lib/build-blocklist.js "$WORK/source.json" "$WORK/out.json" ||
|
|
fail "the transform failed, so nothing was written"
|
|
|
|
if [ -f "$OUTPUT" ] && cmp -s "$WORK/out.json" "$OUTPUT"; then
|
|
echo "vendor-blocklist: $OUTPUT is already up to date"
|
|
return 0
|
|
fi
|
|
|
|
cp "$WORK/out.json" "$OUTPUT"
|
|
echo "vendor-blocklist: wrote $OUTPUT (sha256 $(sha256_of "$OUTPUT"))"
|
|
}
|
|
|
|
main "$@"
|