[tor-bugs] #8338 [Tor bundles/installation]: Write source mirror watch scripts (was: Watch scripts)

[Tor Bug Tracker & Wiki]

#8338: Write source mirror watch scripts
--------------------------------------+-------------------------------------
 Reporter:  ioerror                   |          Owner:  erinn       
     Type:  enhancement               |         Status:  needs_review
 Priority:  major                     |      Milestone:              
Component:  Tor bundles/installation  |        Version:              
 Keywords:  MikePerry201304           |         Parent:  #8288       
   Points:                            |   Actualpoints:  3           
--------------------------------------+-------------------------------------
Changes (by mikeperry):

  * keywords:  => MikePerry201304
  * status:  new => needs_review
  * actualpoints:  => 3


Comment:

 I just pushed a set of watch scripts to mikeperry/ticket8338. I think
 these scripts will allow us to deploy #8286. Please have a look and tell
 me what you think. There are two scripts you should focus on:

 1. This script is meant to be run on people.torproject.org to keep our
 source mirror up to date:
 https://gitweb.torproject.org/mikeperry/torbrowser.git/blob/ticket8338
 :/watch-scripts/fetch-thirdparty.sh

 2. This script is meant to be run on arbitrary machines run by other
 people, to verify the integrity of our mirror against tampering and
 targeted MITM:
 https://gitweb.torproject.org/mikeperry/torbrowser.git/blob/ticket8338
 :/watch-scripts/verify-mirror.sh

 Both scripts are meant to be run from cron. They should be silent except
 in the case of error.

 I think that if enough people run that verification script, it is a better
 solution than requiring manual hash updates in the Makefiles (#8283).

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/8338#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online