From 1ea2cbb678f7263d110138b1f164e1f427b743a1 Mon Sep 17 00:00:00 2001
From: Marc Alexander <admin@m-a-styles.de>
Date: Thu, 10 Aug 2023 20:11:00 +0200
Subject: [PATCH] [ticket/17173] Add scripts for generating and verifying
 package signatures

PHPBB3-17173
---
 build/generate_signature.php | 51 ++++++++++++++++++++++++++++++++
 build/verify_signature.php   | 56 ++++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+)
 create mode 100644 build/generate_signature.php
 create mode 100644 build/verify_signature.php

diff --git a/build/generate_signature.php b/build/generate_signature.php
new file mode 100644
index 0000000000..fa0b7df0bf
--- /dev/null
+++ b/build/generate_signature.php
@@ -0,0 +1,51 @@
+#!/usr/bin/env php
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+if ($_SERVER['argc'] != 3)
+{
+	echo "Please specify the secret key and filename for which the signature should be created, e.g. generate_signature.php mySecretSecret path/to/file\n";
+	exit(1);
+}
+
+$secret_key = base64_decode($_SERVER['argv'][1]);
+$file_path = $_SERVER['argv'][2];
+
+if (!extension_loaded('sodium'))
+{
+	die('Required sodium extension not loaded');
+}
+
+if (!file_exists($file_path))
+{
+	die('File does not exist');
+}
+
+$hash = hash_file('sha384', $file_path, true);
+try
+{
+	$signature = sodium_crypto_sign_detached($hash, $secret_key);
+} catch (SodiumException $e)
+{
+	$keypair = sodium_crypto_sign_keypair();
+
+	$secret_key = base64_encode(sodium_crypto_sign_secretkey($keypair));
+	$public_key = base64_encode(sodium_crypto_sign_publickey($keypair));
+	echo 'Unable to create the signature: ' . $e->getMessage() . "\n";
+	echo "Maybe use these keys:\nPublic key: {$public_key}\nSecret key: {$secret_key}\n";
+	die();
+}
+
+$signature = base64_encode($signature);
+
+file_put_contents($file_path . '.sig', $signature);
diff --git a/build/verify_signature.php b/build/verify_signature.php
new file mode 100644
index 0000000000..fd432ed638
--- /dev/null
+++ b/build/verify_signature.php
@@ -0,0 +1,56 @@
+#!/usr/bin/env php
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+if ($_SERVER['argc'] != 4)
+{
+	echo "Please specify the public key, filename for which the signature should be check, and the signature file, e.g. verify_signature.php superPublicKey path/to/file path/to/signature\n";
+	exit(1);
+}
+
+$public_key = base64_decode($_SERVER['argv'][1]);
+$file_path = $_SERVER['argv'][2];
+$signature_path = $_SERVER['argv'][3];
+
+if (!extension_loaded('sodium'))
+{
+	die('Required sodium extension not loaded');
+}
+
+if (!file_exists($file_path))
+{
+	die('File does not exist');
+}
+
+if (!file_exists($signature_path))
+{
+	die('Signature file does not exist');
+}
+
+$hash = hash_file('sha384', $file_path, true);
+$signature = base64_decode(file_get_contents($signature_path));
+
+try
+{
+	if (sodium_crypto_sign_verify_detached($signature, $hash, $public_key))
+	{
+		echo 'Signature is valid!';
+	}
+	else
+	{
+		echo 'Signature is not valid!';
+	}
+} catch (SodiumException $e)
+{
+	die('Unable to verify the signature: ' . $e->getMessage() . "\n");
+}