From b7b2960e1f1870246f0c113f56d22cfc0f7a4269 Mon Sep 17 00:00:00 2001
From: Robbie Gemmell <robbie@apache.org>
Date: Fri, 15 Sep 2017 16:43:00 +0100
Subject: [PATCH] NO-JIRA: tweaks for the release download helper script -
 Verify the downloaded tar/zip files using their matching signature. -
 Generate SHA512 checksum files for them. - Update downloaded MD5 files to
 allow for simplified CLI tool checks. - Run CLI tool checks on all the
 checksum files.

---
 scripts/download-release.sh | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/scripts/download-release.sh b/scripts/download-release.sh
index 8e038b1c68..42f02f4051 100755
--- a/scripts/download-release.sh
+++ b/scripts/download-release.sh
@@ -50,8 +50,14 @@ doDownload () {
   echo "Downloading $theFile.md5"
   curl $completeURL.md5 > $theFile.md5
 
-  echo "Downloading $theFile.sha1"
-  curl $completeURL.sha1 > $theFile.sha1
+  echo "Verifying signature $theFile.asc"
+  gpg --verify $theFile.asc
+
+  echo "Augmenting $theFile.md5 with filename details"
+  echo "  $theFile" >> $theFile.md5
+
+  echo "Generating SHA512 checksum file $theFile.sha512"
+  sha512sum $theFile > $theFile.sha512
 }
 
 if [ "$#" != 3 ]; then
@@ -73,3 +79,9 @@ doDownload apache-artemis-$release-bin.zip
 doDownload apache-artemis-$release-source-release.tar.gz
 doDownload apache-artemis-$release-source-release.zip
 
+echo "Validating all MD5 checksum files"
+md5sum -c *.md5
+
+echo "Validating all SHA512 checksum files"
+sha512sum -c *.sha512
+