50 lines
2.1 KiB
Python
50 lines
2.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Download a pinned official release and verify its published SHA-256 digest."""
|
|
import hashlib
|
|
import io
|
|
import json
|
|
from pathlib import Path
|
|
import platform
|
|
import shutil
|
|
import tarfile
|
|
import urllib.request
|
|
|
|
VERSION = "1.14.0"
|
|
ROOT = Path(__file__).resolve().parent.parent
|
|
|
|
def download(url):
|
|
req = urllib.request.Request(url, headers={"User-Agent": "MiniVLESS-build"})
|
|
with urllib.request.urlopen(req, timeout=90) as response:
|
|
return response.read()
|
|
|
|
def main():
|
|
if platform.system() != "Linux":
|
|
raise SystemExit("MiniVLESS currently supports Linux only")
|
|
arch = {"x86_64": "amd64", "aarch64": "arm64"}.get(platform.machine())
|
|
if arch is None:
|
|
raise SystemExit("Supported CPU architectures: x86_64 and aarch64")
|
|
name = f"sing-box-{VERSION}-linux-{arch}.tar.gz"
|
|
release = json.loads(download(f"https://api.github.com/repos/SagerNet/sing-box/releases/tags/v{VERSION}"))
|
|
asset = next(a for a in release["assets"] if a["name"] == name)
|
|
payload = download(asset["browser_download_url"])
|
|
expected = asset.get("digest")
|
|
if not expected or expected != "sha256:" + hashlib.sha256(payload).hexdigest():
|
|
raise SystemExit("Missing or mismatched SHA-256: refusing to install this download")
|
|
target = ROOT / "binaries/sing-box"
|
|
target.parent.mkdir(exist_ok=True)
|
|
with tarfile.open(fileobj=io.BytesIO(payload)) as archive:
|
|
member = archive.getmember(f"sing-box-{VERSION}-linux-{arch}/sing-box")
|
|
if not member.isfile():
|
|
raise SystemExit("Invalid archive entry")
|
|
with archive.extractfile(member) as src, target.with_suffix(".new").open("wb") as dst:
|
|
shutil.copyfileobj(src, dst)
|
|
license_data = archive.extractfile(f"sing-box-{VERSION}-linux-{arch}/LICENSE").read()
|
|
(target.parent / "LICENSE.sing-box").write_bytes(license_data)
|
|
target.with_suffix(".new").chmod(0o755)
|
|
target.with_suffix(".new").replace(target)
|
|
print(f"Verified sing-box {VERSION}: {target}")
|
|
print("File capabilities must be reapplied after replacing the binary.")
|
|
|
|
if __name__ == "__main__":
|
|
main()
|