Hello Reader,
In the prior posts I've been posting about using rpm to validate packages, but there are other package managers out there. I've decided to look into each package manager individually and then maybe we can make a conditional script to handle all of them. Here is the yum version:
#!/bin/bash
# Files to store results
VERIFIED="verified"
FAILURES="failures"
DEBUG="debug"
# Clean previous results
> "$VERIFIED"
> "$FAILURES"
> "$DEBUG"
# Iterate over installed packages managed by yum
for package in $(yum list installed | awk 'NR>1 {print $1}' | cut -d. -f1); do
echo "Processing package: $package"
# Find repository URL
repo_url=$(yumdownloader --urls "$package" 2>/dev/null | head -n 1)
if [[ -z "$repo_url" ]]; then
echo "Repository URL not found for package: $package" | tee -a "$FAILURES"
echo "$repo_url $package" | tee -a "$DEBUG"
continue
fi
# Download RPM package temporarily
tmp_rpm="/tmp/${package}.rpm"
curl -s -L "$repo_url" -o "$tmp_rpm"
if [[ ! -f "$tmp_rpm" ]]; then
echo "Failed to download RPM - Package: $package" | tee -a "$FAILURES"
echo "$repo_url $package" | tee -a "$DEBUG"
continue
fi
# Get repository file hashes from the downloaded RPM
repoquery_hashes=$(rpm2cpio "$tmp_rpm" | cpio -idmv --no-absolute-filenames 2>/dev/null; find . -type f -exec sha256sum {} \;)
# Verify files
echo "$repoquery_hashes" | while read -r repo_hash repo_file; do
local_file="/$repo_file"
# Check file existence and type
if [[ ! -x "$local_file" ]] || [[ ! -f "$local_file" ]] || [[ -h "$local_file" ]]; then
continue
fi
# Calculate local disk hash
disk_hash=$(sha256sum "$local_file" 2>/dev/null | awk '{print $1}')
if [[ "$disk_hash" == "$repo_hash" ]]; then
echo "Verified - Package: $package, File: $local_file" >> "$VERIFIED"
else
echo "Hash mismatch (Repository) - Package: $package, File: $local_file" | tee -a "$FAILURES"
echo "$disk_hash $repo_hash $package $local_file" | tee -a "$DEBUG"
fi
done
# Cleanup extracted files and downloaded RPM
rm -rf ./* "$tmp_rpm"
done
echo "Verification complete. Results are stored in '$VERIFIED' and '$FAILURES'."
Post a Comment