Fix hash verification weakness

If cat exists prematurely we might fail to detect trailing malicious garbage in the SPI tarball.
QubesOS · Jun 19, 2021 · 12fd596 · 12fd596
1 parent 084dd1f
commit 12fd596
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/.gitignore b/.gitignore
@@ -8,3 +8,4 @@ config-base-*
 macbook12-spi-driver-*.tar
 macbook12-spi-driver-*.tar.gz.UNTRUSTED
 pkgs
+spi.sha256
diff --git a/Makefile b/Makefile
@@ -97,8 +97,8 @@ $(SRC_TARFILE): $(SRC_FILE)$(UNTRUSTED_SUFF) $(HASH_FILE)
 endif
 
 $(SPI_SRC_TARFILE): $(SPI_SRC_TARFILE)$(UNTRUSTED_SUFF)
-	cat $< | sha256sum | head -c64 | grep -q "^$(SPI_HASH_SHA256)$$"
-	mv $< $@
+	$(file > spi.sha256,$(SPI_HASH_SHA256)  $(SPI_SRC_TARFILE)$(UNTRUSTED_SUFF))
+	sha256sum -c spi.sha256 && mv $< $@ && rm spi.sha256
 
 $(SRC_FILE)$(UNTRUSTED_SUFF):
 	@$(FETCH_CMD) $@ -- $(URL)