apple_kit

Apple-native services for Radroots iOS and macOS apps
git clone https://radroots.dev/git/apple_kit.git
Log | Files | Refs | README | LICENSE

verify-supply-chain.sh (1155B)

      1 #!/usr/bin/env bash
      2 set -euo pipefail
      3 
      4 repo_root="$(git rev-parse --show-toplevel)"
      5 cd "$repo_root"
      6 
      7 dependency_url="https://github.com/21-DOT-DEV/swift-secp256k1.git"
      8 dependency_revision="e70a10e036a55fffea31568f0af92d69b6d449cd"
      9 
     10 test "$(grep -F -c "url: \"$dependency_url\"" Package.swift)" -eq 1
     11 test "$(grep -F -c "revision: \"$dependency_revision\"" Package.swift)" -eq 1
     12 test "$(grep -E -c '^[[:space:]]*\.package\(' Package.swift)" -eq 1
     13 test "$(grep -F -c "\"location\" : \"$dependency_url\"" Package.resolved)" -eq 1
     14 test "$(grep -F -c "\"revision\" : \"$dependency_revision\"" Package.resolved)" -eq 1
     15 
     16 if grep -E -q '\.package\((path:|.*branch:|.*from:|.*exact:)' Package.swift; then
     17   echo "supply_chain_invalid: dependency must use only the governed immutable revision" >&2
     18   exit 1
     19 fi
     20 
     21 test "$(grep -F -c '"identity" : "swift-secp256k1"' Package.resolved)" -eq 1
     22 test "$(grep -F -c '"identity" :' Package.resolved)" -eq 1
     23 test "$(grep -F -c '"kind" : "remoteSourceControl"' Package.resolved)" -eq 1
     24 grep -F -q 'GPL-3.0-or-later' README
     25 grep -F -q 'GNU GENERAL PUBLIC LICENSE' LICENSE
     26 
     27 echo "supply-chain ok: one immutable Swift dependency"