tool/src-verify.c

   1 /*
   2 ** This utility program reads the "manifest" and "manifest.uuid" files
   3 ** in a Fossil-generated source tree (where the repository has the
   4 ** "manifest" setting turned on - this is true for SQLite and Fossil itself)
   5 ** and verifies that the source code files are complete and unaltered by
   6 ** checking the SHA1 and SHA3 hashes of the source files contained in the
   7 ** "manifest" file.
   8 **
   9 ** On success it prints:  "OK $HASH" where $HASH is the SHA3-256 hash of
  10 ** the check-in for the source tree.  If it finds any discrepencies, it
  11 ** prints "Derived from $HASH with changes to:" followed by a list of files
  12 ** which have been altered.
  13 **
  14 ** USAGE:
  15 **
  16 **     src-verify [-x] [-v] $(ROOT)
  17 **
  18 ** Where ROOT is the root of the source tree - the directory that contains
  19 ** the "manifest" and "manifest.uuid" files.  Add the "-v" option for
  20 ** some debugging output.  With the -x option, the output is in a format
  21 ** that is intended to be read by a script rather by a human.  The -x output
  22 ** format always has the SHA3 hash of the source check-in on the first line
  23 ** and lists files that have changed on subsequent lines.
  24 **
  25 ** Additional debugging options:
  26 **
  27 **     src-verify --sha1 FILE ...
  28 **     src-verify --sha3 FILE ...
  29 **
  30 ** Compute the SHA1 or SHA3-256 hashes for all of the FILEs named
  31 **
  32 ** COMPILING:
  33 **
  34 ** This utility is self-contained.  It uses only the standard library.
  35 ** There are no other dependencies.  Just compile it and run it.
  36 **
  37 ** LIMITATIONS:
  38 **
  39 **   *   This utility assumes that the check-in hash uses SHA3-256.
  40 **       It is ok for individual file hashes to be SHA1, but the
  41 **       check-in itself must use a SHA3-256 hash.
  42 */
  43 #include <stdio.h>
  44 #include <string.h>
  45 #include <stdlib.h>
  46 #if !defined(_WIN32)
  47 # include <unistd.h>
  48 #else
  49 # include <io.h>
  50 # ifndef R_OK
  51 #   define R_OK 04
  52 # endif
  53 # ifndef access
  54 #   define access(f,m) _access((f),(m))
  55 # endif
  56 #endif
  57 typedef unsigned long long int u64;
  58
  59 /*
  60 ** The SHA1 implementation below is adapted from:
  61 **
  62 **  $NetBSD: sha1.c,v 1.6 2009/11/06 20:31:18 joerg Exp $
  63 **  $OpenBSD: sha1.c,v 1.9 1997/07/23 21:12:32 kstailey Exp $
  64 **
  65 ** SHA-1 in C
  66 ** By Steve Reid <steve@edmweb.com>
  67 ** 100% Public Domain
  68 */
  69 typedef struct SHA1Context SHA1Context;
  70 struct SHA1Context {
  71   unsigned int state[5];
  72   unsigned int count[2];
  73   unsigned char buffer[64];
  74 };
  75
  76 /*
  77  * blk0() and blk() perform the initial expand.
  78  * I got the idea of expanding during the round function from SSLeay
  79  *
  80  * blk0le() for little-endian and blk0be() for big-endian.
  81  */
  82 #define SHA_ROT(x,l,r) ((x) << (l) | (x) >> (r))
  83 #define rol(x,k) SHA_ROT(x,k,32-(k))
  84 #define ror(x,k) SHA_ROT(x,32-(k),k)
  85 #define blk0le(i) (block[i] = (ror(block[i],8)&0xFF00FF00) \
  86     |(rol(block[i],8)&0x00FF00FF))
  87 #define blk0be(i) block[i]
  88 #define blk(i) (block[i&15] = rol(block[(i+13)&15]^block[(i+8)&15] \
  89     ^block[(i+2)&15]^block[i&15],1))
  90
  91 /*
  92  * (R0+R1), R2, R3, R4 are the different operations (rounds) used in SHA1
  93  *
  94  * Rl0() for little-endian and Rb0() for big-endian.  Endianness is
  95  * determined at run-time.
  96  */
  97 #define Rl0(v,w,x,y,z,i) \
  98     z+=((w&(x^y))^y)+blk0le(i)+0x5A827999+rol(v,5);w=ror(w,2);
  99 #define Rb0(v,w,x,y,z,i) \
 100     z+=((w&(x^y))^y)+blk0be(i)+0x5A827999+rol(v,5);w=ror(w,2);
 101 #define R1(v,w,x,y,z,i) \
 102     z+=((w&(x^y))^y)+blk(i)+0x5A827999+rol(v,5);w=ror(w,2);
 103 #define R2(v,w,x,y,z,i) \
 104     z+=(w^x^y)+blk(i)+0x6ED9EBA1+rol(v,5);w=ror(w,2);
 105 #define R3(v,w,x,y,z,i) \
 106     z+=(((w|x)&y)|(w&x))+blk(i)+0x8F1BBCDC+rol(v,5);w=ror(w,2);
 107 #define R4(v,w,x,y,z,i) \
 108     z+=(w^x^y)+blk(i)+0xCA62C1D6+rol(v,5);w=ror(w,2);
 109
 110 /*
 111  * Hash a single 512-bit block. This is the core of the algorithm.
 112  */
 113 #define a qq[0]
 114 #define b qq[1]
 115 #define c qq[2]
 116 #define d qq[3]
 117 #define e qq[4]
 118
 119 void SHA1Transform(unsigned int state[5], const unsigned char buffer[64])
 120 {
 121   unsigned int qq[5]; /* a, b, c, d, e; */
 122   static int one = 1;
 123   unsigned int block[16];
 124   memcpy(block, buffer, 64);
 125   memcpy(qq,state,5*sizeof(unsigned int));
 126
 127   /* Copy context->state[] to working vars */
 128   /*
 129   a = state[0];
 130   b = state[1];
 131   c = state[2];
 132   d = state[3];
 133   e = state[4];
 134   */
 135
 136   /* 4 rounds of 20 operations each. Loop unrolled. */
 137   if( 1 == *(unsigned char*)&one ){
 138     Rl0(a,b,c,d,e, 0); Rl0(e,a,b,c,d, 1); Rl0(d,e,a,b,c, 2); Rl0(c,d,e,a,b, 3);
 139     Rl0(b,c,d,e,a, 4); Rl0(a,b,c,d,e, 5); Rl0(e,a,b,c,d, 6); Rl0(d,e,a,b,c, 7);
 140     Rl0(c,d,e,a,b, 8); Rl0(b,c,d,e,a, 9); Rl0(a,b,c,d,e,10); Rl0(e,a,b,c,d,11);
 141     Rl0(d,e,a,b,c,12); Rl0(c,d,e,a,b,13); Rl0(b,c,d,e,a,14); Rl0(a,b,c,d,e,15);
 142   }else{
 143     Rb0(a,b,c,d,e, 0); Rb0(e,a,b,c,d, 1); Rb0(d,e,a,b,c, 2); Rb0(c,d,e,a,b, 3);
 144     Rb0(b,c,d,e,a, 4); Rb0(a,b,c,d,e, 5); Rb0(e,a,b,c,d, 6); Rb0(d,e,a,b,c, 7);
 145     Rb0(c,d,e,a,b, 8); Rb0(b,c,d,e,a, 9); Rb0(a,b,c,d,e,10); Rb0(e,a,b,c,d,11);
 146     Rb0(d,e,a,b,c,12); Rb0(c,d,e,a,b,13); Rb0(b,c,d,e,a,14); Rb0(a,b,c,d,e,15);
 147   }
 148   R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
 149   R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
 150   R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
 151   R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
 152   R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
 153   R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
 154   R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
 155   R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
 156   R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
 157   R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
 158   R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
 159   R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
 160   R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
 161   R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
 162   R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
 163   R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
 164
 165   /* Add the working vars back into context.state[] */
 166   state[0] += a;
 167   state[1] += b;
 168   state[2] += c;
 169   state[3] += d;
 170   state[4] += e;
 171 }
 172
 173 /*
 174  * SHA1Init - Initialize new context
 175  */
 176 static void SHA1Init(SHA1Context *context){
 177     /* SHA1 initialization constants */
 178     context->state[0] = 0x67452301;
 179     context->state[1] = 0xEFCDAB89;
 180     context->state[2] = 0x98BADCFE;
 181     context->state[3] = 0x10325476;
 182     context->state[4] = 0xC3D2E1F0;
 183     context->count[0] = context->count[1] = 0;
 184 }
 185
 186
 187 /*
 188  * Run your data through this.
 189  */
 190 static void SHA1Update(
 191   SHA1Context *context,
 192   const unsigned char *data,
 193   unsigned int len
 194 ){
 195     unsigned int i, j;
 196
 197     j = context->count[0];
 198     if ((context->count[0] += len << 3) < j)
 199         context->count[1] += (len>>29)+1;
 200     j = (j >> 3) & 63;
 201     if ((j + len) > 63) {
 202         (void)memcpy(&context->buffer[j], data, (i = 64-j));
 203         SHA1Transform(context->state, context->buffer);
 204         for ( ; i + 63 < len; i += 64)
 205             SHA1Transform(context->state, &data[i]);
 206         j = 0;
 207     } else {
 208         i = 0;
 209     }
 210     (void)memcpy(&context->buffer[j], &data[i], len - i);
 211 }
 212
 213
 214 /*
 215  * Add padding and return the message digest.
 216  */
 217 static void SHA1Final(unsigned char *digest, SHA1Context *context){
 218     unsigned int i;
 219     unsigned char finalcount[8];
 220
 221     for (i = 0; i < 8; i++) {
 222         finalcount[i] = (unsigned char)((context->count[(i >= 4 ? 0 : 1)]
 223          >> ((3-(i & 3)) * 8) ) & 255); /* Endian independent */
 224     }
 225     SHA1Update(context, (const unsigned char *)"\200", 1);
 226     while ((context->count[0] & 504) != 448)
 227         SHA1Update(context, (const unsigned char *)"\0", 1);
 228     SHA1Update(context, finalcount, 8);  /* Should cause a SHA1Transform() */
 229
 230     if (digest) {
 231         for (i = 0; i < 20; i++)
 232             digest[i] = (unsigned char)
 233                 ((context->state[i>>2] >> ((3-(i & 3)) * 8) ) & 255);
 234     }
 235 }
 236
 237
 238 /*
 239 ** Macros to determine whether the machine is big or little endian,
 240 ** and whether or not that determination is run-time or compile-time.
 241 **
 242 ** For best performance, an attempt is made to guess at the byte-order
 243 ** using C-preprocessor macros.  If that is unsuccessful, or if
 244 ** -DSHA3_BYTEORDER=0 is set, then byte-order is determined
 245 ** at run-time.
 246 */
 247 #ifndef SHA3_BYTEORDER
 248 # if defined(i386)     || defined(__i386__)   || defined(_M_IX86) ||    \
 249      defined(__x86_64) || defined(__x86_64__) || defined(_M_X64)  ||    \
 250      defined(_M_AMD64) || defined(_M_ARM)     || defined(__x86)   ||    \
 251      defined(__arm__)
 252 #   define SHA3_BYTEORDER    1234
 253 # elif defined(sparc)    || defined(__ppc__)
 254 #   define SHA3_BYTEORDER    4321
 255 # else
 256 #   define SHA3_BYTEORDER 0
 257 # endif
 258 #endif
 259
 260
 261 /*
 262 ** State structure for a SHA3 hash in progress
 263 */
 264 typedef struct SHA3Context SHA3Context;
 265 struct SHA3Context {
 266   union {
 267     u64 s[25];                /* Keccak state. 5x5 lines of 64 bits each */
 268     unsigned char x[1600];    /* ... or 1600 bytes */
 269   } u;
 270   unsigned nRate;        /* Bytes of input accepted per Keccak iteration */
 271   unsigned nLoaded;      /* Input bytes loaded into u.x[] so far this cycle */
 272   unsigned ixMask;       /* Insert next input into u.x[nLoaded^ixMask]. */
 273 };
 274
 275 /*
 276 ** A single step of the Keccak mixing function for a 1600-bit state
 277 */
 278 static void KeccakF1600Step(SHA3Context *p){
 279   int i;
 280   u64 B0, B1, B2, B3, B4;
 281   u64 C0, C1, C2, C3, C4;
 282   u64 D0, D1, D2, D3, D4;
 283   static const u64 RC[] = {
 284     0x0000000000000001ULL,  0x0000000000008082ULL,
 285     0x800000000000808aULL,  0x8000000080008000ULL,
 286     0x000000000000808bULL,  0x0000000080000001ULL,
 287     0x8000000080008081ULL,  0x8000000000008009ULL,
 288     0x000000000000008aULL,  0x0000000000000088ULL,
 289     0x0000000080008009ULL,  0x000000008000000aULL,
 290     0x000000008000808bULL,  0x800000000000008bULL,
 291     0x8000000000008089ULL,  0x8000000000008003ULL,
 292     0x8000000000008002ULL,  0x8000000000000080ULL,
 293     0x000000000000800aULL,  0x800000008000000aULL,
 294     0x8000000080008081ULL,  0x8000000000008080ULL,
 295     0x0000000080000001ULL,  0x8000000080008008ULL
 296   };
 297 # define A00 (p->u.s[0])
 298 # define A01 (p->u.s[1])
 299 # define A02 (p->u.s[2])
 300 # define A03 (p->u.s[3])
 301 # define A04 (p->u.s[4])
 302 # define A10 (p->u.s[5])
 303 # define A11 (p->u.s[6])
 304 # define A12 (p->u.s[7])
 305 # define A13 (p->u.s[8])
 306 # define A14 (p->u.s[9])
 307 # define A20 (p->u.s[10])
 308 # define A21 (p->u.s[11])
 309 # define A22 (p->u.s[12])
 310 # define A23 (p->u.s[13])
 311 # define A24 (p->u.s[14])
 312 # define A30 (p->u.s[15])
 313 # define A31 (p->u.s[16])
 314 # define A32 (p->u.s[17])
 315 # define A33 (p->u.s[18])
 316 # define A34 (p->u.s[19])
 317 # define A40 (p->u.s[20])
 318 # define A41 (p->u.s[21])
 319 # define A42 (p->u.s[22])
 320 # define A43 (p->u.s[23])
 321 # define A44 (p->u.s[24])
 322 # define ROL64(a,x) ((a<<x)|(a>>(64-x)))
 323
 324   for(i=0; i<24; i+=4){
 325     C0 = A00^A10^A20^A30^A40;
 326     C1 = A01^A11^A21^A31^A41;
 327     C2 = A02^A12^A22^A32^A42;
 328     C3 = A03^A13^A23^A33^A43;
 329     C4 = A04^A14^A24^A34^A44;
 330     D0 = C4^ROL64(C1, 1);
 331     D1 = C0^ROL64(C2, 1);
 332     D2 = C1^ROL64(C3, 1);
 333     D3 = C2^ROL64(C4, 1);
 334     D4 = C3^ROL64(C0, 1);
 335
 336     B0 = (A00^D0);
 337     B1 = ROL64((A11^D1), 44);
 338     B2 = ROL64((A22^D2), 43);
 339     B3 = ROL64((A33^D3), 21);
 340     B4 = ROL64((A44^D4), 14);
 341     A00 =   B0 ^((~B1)&  B2 );
 342     A00 ^= RC[i];
 343     A11 =   B1 ^((~B2)&  B3 );
 344     A22 =   B2 ^((~B3)&  B4 );
 345     A33 =   B3 ^((~B4)&  B0 );
 346     A44 =   B4 ^((~B0)&  B1 );
 347
 348     B2 = ROL64((A20^D0), 3);
 349     B3 = ROL64((A31^D1), 45);
 350     B4 = ROL64((A42^D2), 61);
 351     B0 = ROL64((A03^D3), 28);
 352     B1 = ROL64((A14^D4), 20);
 353     A20 =   B0 ^((~B1)&  B2 );
 354     A31 =   B1 ^((~B2)&  B3 );
 355     A42 =   B2 ^((~B3)&  B4 );
 356     A03 =   B3 ^((~B4)&  B0 );
 357     A14 =   B4 ^((~B0)&  B1 );
 358
 359     B4 = ROL64((A40^D0), 18);
 360     B0 = ROL64((A01^D1), 1);
 361     B1 = ROL64((A12^D2), 6);
 362     B2 = ROL64((A23^D3), 25);
 363     B3 = ROL64((A34^D4), 8);
 364     A40 =   B0 ^((~B1)&  B2 );
 365     A01 =   B1 ^((~B2)&  B3 );
 366     A12 =   B2 ^((~B3)&  B4 );
 367     A23 =   B3 ^((~B4)&  B0 );
 368     A34 =   B4 ^((~B0)&  B1 );
 369
 370     B1 = ROL64((A10^D0), 36);
 371     B2 = ROL64((A21^D1), 10);
 372     B3 = ROL64((A32^D2), 15);
 373     B4 = ROL64((A43^D3), 56);
 374     B0 = ROL64((A04^D4), 27);
 375     A10 =   B0 ^((~B1)&  B2 );
 376     A21 =   B1 ^((~B2)&  B3 );
 377     A32 =   B2 ^((~B3)&  B4 );
 378     A43 =   B3 ^((~B4)&  B0 );
 379     A04 =   B4 ^((~B0)&  B1 );
 380
 381     B3 = ROL64((A30^D0), 41);
 382     B4 = ROL64((A41^D1), 2);
 383     B0 = ROL64((A02^D2), 62);
 384     B1 = ROL64((A13^D3), 55);
 385     B2 = ROL64((A24^D4), 39);
 386     A30 =   B0 ^((~B1)&  B2 );
 387     A41 =   B1 ^((~B2)&  B3 );
 388     A02 =   B2 ^((~B3)&  B4 );
 389     A13 =   B3 ^((~B4)&  B0 );
 390     A24 =   B4 ^((~B0)&  B1 );
 391
 392     C0 = A00^A20^A40^A10^A30;
 393     C1 = A11^A31^A01^A21^A41;
 394     C2 = A22^A42^A12^A32^A02;
 395     C3 = A33^A03^A23^A43^A13;
 396     C4 = A44^A14^A34^A04^A24;
 397     D0 = C4^ROL64(C1, 1);
 398     D1 = C0^ROL64(C2, 1);
 399     D2 = C1^ROL64(C3, 1);
 400     D3 = C2^ROL64(C4, 1);
 401     D4 = C3^ROL64(C0, 1);
 402
 403     B0 = (A00^D0);
 404     B1 = ROL64((A31^D1), 44);
 405     B2 = ROL64((A12^D2), 43);
 406     B3 = ROL64((A43^D3), 21);
 407     B4 = ROL64((A24^D4), 14);
 408     A00 =   B0 ^((~B1)&  B2 );
 409     A00 ^= RC[i+1];
 410     A31 =   B1 ^((~B2)&  B3 );
 411     A12 =   B2 ^((~B3)&  B4 );
 412     A43 =   B3 ^((~B4)&  B0 );
 413     A24 =   B4 ^((~B0)&  B1 );
 414
 415     B2 = ROL64((A40^D0), 3);
 416     B3 = ROL64((A21^D1), 45);
 417     B4 = ROL64((A02^D2), 61);
 418     B0 = ROL64((A33^D3), 28);
 419     B1 = ROL64((A14^D4), 20);
 420     A40 =   B0 ^((~B1)&  B2 );
 421     A21 =   B1 ^((~B2)&  B3 );
 422     A02 =   B2 ^((~B3)&  B4 );
 423     A33 =   B3 ^((~B4)&  B0 );
 424     A14 =   B4 ^((~B0)&  B1 );
 425
 426     B4 = ROL64((A30^D0), 18);
 427     B0 = ROL64((A11^D1), 1);
 428     B1 = ROL64((A42^D2), 6);
 429     B2 = ROL64((A23^D3), 25);
 430     B3 = ROL64((A04^D4), 8);
 431     A30 =   B0 ^((~B1)&  B2 );
 432     A11 =   B1 ^((~B2)&  B3 );
 433     A42 =   B2 ^((~B3)&  B4 );
 434     A23 =   B3 ^((~B4)&  B0 );
 435     A04 =   B4 ^((~B0)&  B1 );
 436
 437     B1 = ROL64((A20^D0), 36);
 438     B2 = ROL64((A01^D1), 10);
 439     B3 = ROL64((A32^D2), 15);
 440     B4 = ROL64((A13^D3), 56);
 441     B0 = ROL64((A44^D4), 27);
 442     A20 =   B0 ^((~B1)&  B2 );
 443     A01 =   B1 ^((~B2)&  B3 );
 444     A32 =   B2 ^((~B3)&  B4 );
 445     A13 =   B3 ^((~B4)&  B0 );
 446     A44 =   B4 ^((~B0)&  B1 );
 447
 448     B3 = ROL64((A10^D0), 41);
 449     B4 = ROL64((A41^D1), 2);
 450     B0 = ROL64((A22^D2), 62);
 451     B1 = ROL64((A03^D3), 55);
 452     B2 = ROL64((A34^D4), 39);
 453     A10 =   B0 ^((~B1)&  B2 );
 454     A41 =   B1 ^((~B2)&  B3 );
 455     A22 =   B2 ^((~B3)&  B4 );
 456     A03 =   B3 ^((~B4)&  B0 );
 457     A34 =   B4 ^((~B0)&  B1 );
 458
 459     C0 = A00^A40^A30^A20^A10;
 460     C1 = A31^A21^A11^A01^A41;
 461     C2 = A12^A02^A42^A32^A22;
 462     C3 = A43^A33^A23^A13^A03;
 463     C4 = A24^A14^A04^A44^A34;
 464     D0 = C4^ROL64(C1, 1);
 465     D1 = C0^ROL64(C2, 1);
 466     D2 = C1^ROL64(C3, 1);
 467     D3 = C2^ROL64(C4, 1);
 468     D4 = C3^ROL64(C0, 1);
 469
 470     B0 = (A00^D0);
 471     B1 = ROL64((A21^D1), 44);
 472     B2 = ROL64((A42^D2), 43);
 473     B3 = ROL64((A13^D3), 21);
 474     B4 = ROL64((A34^D4), 14);
 475     A00 =   B0 ^((~B1)&  B2 );
 476     A00 ^= RC[i+2];
 477     A21 =   B1 ^((~B2)&  B3 );
 478     A42 =   B2 ^((~B3)&  B4 );
 479     A13 =   B3 ^((~B4)&  B0 );
 480     A34 =   B4 ^((~B0)&  B1 );
 481
 482     B2 = ROL64((A30^D0), 3);
 483     B3 = ROL64((A01^D1), 45);
 484     B4 = ROL64((A22^D2), 61);
 485     B0 = ROL64((A43^D3), 28);
 486     B1 = ROL64((A14^D4), 20);
 487     A30 =   B0 ^((~B1)&  B2 );
 488     A01 =   B1 ^((~B2)&  B3 );
 489     A22 =   B2 ^((~B3)&  B4 );
 490     A43 =   B3 ^((~B4)&  B0 );
 491     A14 =   B4 ^((~B0)&  B1 );
 492
 493     B4 = ROL64((A10^D0), 18);
 494     B0 = ROL64((A31^D1), 1);
 495     B1 = ROL64((A02^D2), 6);
 496     B2 = ROL64((A23^D3), 25);
 497     B3 = ROL64((A44^D4), 8);
 498     A10 =   B0 ^((~B1)&  B2 );
 499     A31 =   B1 ^((~B2)&  B3 );
 500     A02 =   B2 ^((~B3)&  B4 );
 501     A23 =   B3 ^((~B4)&  B0 );
 502     A44 =   B4 ^((~B0)&  B1 );
 503
 504     B1 = ROL64((A40^D0), 36);
 505     B2 = ROL64((A11^D1), 10);
 506     B3 = ROL64((A32^D2), 15);
 507     B4 = ROL64((A03^D3), 56);
 508     B0 = ROL64((A24^D4), 27);
 509     A40 =   B0 ^((~B1)&  B2 );
 510     A11 =   B1 ^((~B2)&  B3 );
 511     A32 =   B2 ^((~B3)&  B4 );
 512     A03 =   B3 ^((~B4)&  B0 );
 513     A24 =   B4 ^((~B0)&  B1 );
 514
 515     B3 = ROL64((A20^D0), 41);
 516     B4 = ROL64((A41^D1), 2);
 517     B0 = ROL64((A12^D2), 62);
 518     B1 = ROL64((A33^D3), 55);
 519     B2 = ROL64((A04^D4), 39);
 520     A20 =   B0 ^((~B1)&  B2 );
 521     A41 =   B1 ^((~B2)&  B3 );
 522     A12 =   B2 ^((~B3)&  B4 );
 523     A33 =   B3 ^((~B4)&  B0 );
 524     A04 =   B4 ^((~B0)&  B1 );
 525
 526     C0 = A00^A30^A10^A40^A20;
 527     C1 = A21^A01^A31^A11^A41;
 528     C2 = A42^A22^A02^A32^A12;
 529     C3 = A13^A43^A23^A03^A33;
 530     C4 = A34^A14^A44^A24^A04;
 531     D0 = C4^ROL64(C1, 1);
 532     D1 = C0^ROL64(C2, 1);
 533     D2 = C1^ROL64(C3, 1);
 534     D3 = C2^ROL64(C4, 1);
 535     D4 = C3^ROL64(C0, 1);
 536
 537     B0 = (A00^D0);
 538     B1 = ROL64((A01^D1), 44);
 539     B2 = ROL64((A02^D2), 43);
 540     B3 = ROL64((A03^D3), 21);
 541     B4 = ROL64((A04^D4), 14);
 542     A00 =   B0 ^((~B1)&  B2 );
 543     A00 ^= RC[i+3];
 544     A01 =   B1 ^((~B2)&  B3 );
 545     A02 =   B2 ^((~B3)&  B4 );
 546     A03 =   B3 ^((~B4)&  B0 );
 547     A04 =   B4 ^((~B0)&  B1 );
 548
 549     B2 = ROL64((A10^D0), 3);
 550     B3 = ROL64((A11^D1), 45);
 551     B4 = ROL64((A12^D2), 61);
 552     B0 = ROL64((A13^D3), 28);
 553     B1 = ROL64((A14^D4), 20);
 554     A10 =   B0 ^((~B1)&  B2 );
 555     A11 =   B1 ^((~B2)&  B3 );
 556     A12 =   B2 ^((~B3)&  B4 );
 557     A13 =   B3 ^((~B4)&  B0 );
 558     A14 =   B4 ^((~B0)&  B1 );
 559
 560     B4 = ROL64((A20^D0), 18);
 561     B0 = ROL64((A21^D1), 1);
 562     B1 = ROL64((A22^D2), 6);
 563     B2 = ROL64((A23^D3), 25);
 564     B3 = ROL64((A24^D4), 8);
 565     A20 =   B0 ^((~B1)&  B2 );
 566     A21 =   B1 ^((~B2)&  B3 );
 567     A22 =   B2 ^((~B3)&  B4 );
 568     A23 =   B3 ^((~B4)&  B0 );
 569     A24 =   B4 ^((~B0)&  B1 );
 570
 571     B1 = ROL64((A30^D0), 36);
 572     B2 = ROL64((A31^D1), 10);
 573     B3 = ROL64((A32^D2), 15);
 574     B4 = ROL64((A33^D3), 56);
 575     B0 = ROL64((A34^D4), 27);
 576     A30 =   B0 ^((~B1)&  B2 );
 577     A31 =   B1 ^((~B2)&  B3 );
 578     A32 =   B2 ^((~B3)&  B4 );
 579     A33 =   B3 ^((~B4)&  B0 );
 580     A34 =   B4 ^((~B0)&  B1 );
 581
 582     B3 = ROL64((A40^D0), 41);
 583     B4 = ROL64((A41^D1), 2);
 584     B0 = ROL64((A42^D2), 62);
 585     B1 = ROL64((A43^D3), 55);
 586     B2 = ROL64((A44^D4), 39);
 587     A40 =   B0 ^((~B1)&  B2 );
 588     A41 =   B1 ^((~B2)&  B3 );
 589     A42 =   B2 ^((~B3)&  B4 );
 590     A43 =   B3 ^((~B4)&  B0 );
 591     A44 =   B4 ^((~B0)&  B1 );
 592   }
 593 }
 594
 595 /*
 596 ** Initialize a new hash.  iSize determines the size of the hash
 597 ** in bits and should be one of 224, 256, 384, or 512.  Or iSize
 598 ** can be zero to use the default hash size of 256 bits.
 599 */
 600 static void SHA3Init(SHA3Context *p, int iSize){
 601   memset(p, 0, sizeof(*p));
 602   if( iSize>=128 && iSize<=512 ){
 603     p->nRate = (1600 - ((iSize + 31)&~31)*2)/8;
 604   }else{
 605     p->nRate = (1600 - 2*256)/8;
 606   }
 607 #if SHA3_BYTEORDER==1234
 608   /* Known to be little-endian at compile-time. No-op */
 609 #elif SHA3_BYTEORDER==4321
 610   p->ixMask = 7;  /* Big-endian */
 611 #else
 612   {
 613     static unsigned int one = 1;
 614     if( 1==*(unsigned char*)&one ){
 615       /* Little endian.  No byte swapping. */
 616       p->ixMask = 0;
 617     }else{
 618       /* Big endian.  Byte swap. */
 619       p->ixMask = 7;
 620     }
 621   }
 622 #endif
 623 }
 624
 625 /*
 626 ** Make consecutive calls to the SHA3Update function to add new content
 627 ** to the hash
 628 */
 629 static void SHA3Update(
 630   SHA3Context *p,
 631   const unsigned char *aData,
 632   unsigned int nData
 633 ){
 634   unsigned int i = 0;
 635 #if SHA3_BYTEORDER==1234
 636   if( (p->nLoaded % 8)==0 && ((aData - (const unsigned char*)0)&7)==0 ){
 637     for(; i+7<nData; i+=8){
 638       p->u.s[p->nLoaded/8] ^= *(u64*)&aData[i];
 639       p->nLoaded += 8;
 640       if( p->nLoaded>=p->nRate ){
 641         KeccakF1600Step(p);
 642         p->nLoaded = 0;
 643       }
 644     }
 645   }
 646 #endif
 647   for(; i<nData; i++){
 648 #if SHA3_BYTEORDER==1234
 649     p->u.x[p->nLoaded] ^= aData[i];
 650 #elif SHA3_BYTEORDER==4321
 651     p->u.x[p->nLoaded^0x07] ^= aData[i];
 652 #else
 653     p->u.x[p->nLoaded^p->ixMask] ^= aData[i];
 654 #endif
 655     p->nLoaded++;
 656     if( p->nLoaded==p->nRate ){
 657       KeccakF1600Step(p);
 658       p->nLoaded = 0;
 659     }
 660   }
 661 }
 662
 663 /*
 664 ** After all content has been added, invoke SHA3Final() to compute
 665 ** the final hash.  The function returns a pointer to the binary
 666 ** hash value.
 667 */
 668 static unsigned char *SHA3Final(SHA3Context *p){
 669   unsigned int i;
 670   if( p->nLoaded==p->nRate-1 ){
 671     const unsigned char c1 = 0x86;
 672     SHA3Update(p, &c1, 1);
 673   }else{
 674     const unsigned char c2 = 0x06;
 675     const unsigned char c3 = 0x80;
 676     SHA3Update(p, &c2, 1);
 677     p->nLoaded = p->nRate - 1;
 678     SHA3Update(p, &c3, 1);
 679   }
 680   for(i=0; i<p->nRate; i++){
 681     p->u.x[i+p->nRate] = p->u.x[i^p->ixMask];
 682   }
 683   return &p->u.x[p->nRate];
 684 }
 685
 686 /*
 687 ** Convert a digest into base-16.
 688 */
 689 static void DigestToBase16(unsigned char *digest, char *zBuf, int nByte){
 690   static const char zEncode[] = "0123456789abcdef";
 691   int ix;
 692
 693   for(ix=0; ix<nByte; ix++){
 694     *zBuf++ = zEncode[(*digest>>4)&0xf];
 695     *zBuf++ = zEncode[*digest++ & 0xf];
 696   }
 697   *zBuf = '\0';
 698 }
 699
 700 /*
 701 ** Compute the SHA3-256 checksum of a file on disk.  Store the resulting
 702 ** checksum in the zCksum.
 703 **
 704 ** Return the number of errors.
 705 */
 706 void sha3sum_file(const char *zFilename, char *zCksum){
 707   FILE *in;
 708   SHA3Context ctx;
 709   char zBuf[10240];
 710
 711   in = fopen(zFilename,"rb");
 712   if( in==0 ){
 713     zCksum[0] = 0;
 714     return;
 715   }
 716   SHA3Init(&ctx, 256);
 717   for(;;){
 718     size_t n;
 719     n = fread(zBuf, 1, sizeof(zBuf), in);
 720     if( n<=0 ) break;
 721     SHA3Update(&ctx, (unsigned char*)zBuf, (unsigned)n);
 722   }
 723   fclose(in);
 724   DigestToBase16(SHA3Final(&ctx), zCksum, 32);
 725 }
 726
 727 /*
 728 ** Compute the SHA1 checksum of a file on disk.  Store the resulting
 729 ** checksum in the zCksum.
 730 **
 731 ** Return the number of errors.
 732 */
 733 void sha1sum_file(const char *zFilename, char *zCksum){
 734   FILE *in;
 735   SHA1Context ctx;
 736   unsigned char zResult[20];
 737   char zBuf[10240];
 738
 739   in = fopen(zFilename,"rb");
 740   if( in==0 ){
 741     zCksum[0] = 0;
 742     return;
 743   }
 744   SHA1Init(&ctx);
 745   for(;;){
 746     size_t n;
 747     n = fread(zBuf, 1, sizeof(zBuf), in);
 748     if( n<=0 ) break;
 749     SHA1Update(&ctx, (unsigned char*)zBuf, (unsigned)n);
 750   }
 751   fclose(in);
 752   SHA1Final(zResult, &ctx);
 753   DigestToBase16(zResult, zCksum, 20);
 754 }
 755
 756 /*
 757 ** Decode a fossilized string in-place.
 758 */
 759 void defossilize(char *z){
 760   int i, j, cc;
 761   char *zSlash = strchr(z, '\\');
 762   if( zSlash==0 ) return;
 763   i = zSlash - z;
 764   for(j=i; (cc=z[i])!=0; i++){
 765     if( cc=='\\' && z[i+1] ){
 766       i++;
 767       switch( z[i] ){
 768         case 'n':  cc = '\n';  break;
 769         case 's':  cc = ' ';   break;
 770         case 't':  cc = '\t';  break;
 771         case 'r':  cc = '\r';  break;
 772         case 'v':  cc = '\v';  break;
 773         case 'f':  cc = '\f';  break;
 774         case '0':  cc = 0;     break;
 775         case '\\': cc = '\\';  break;
 776         default:   cc = z[i];  break;
 777       }
 778     }
 779     z[j++] = cc;
 780   }
 781   if( z[j] ) z[j] = 0;
 782 }
 783
 784 /*
 785 ** Report that a single file is incorrect.
 786 */
 787 static void errorMsg(int *pnErr, const char *zVers, const char *zFile){
 788   if( *pnErr==0 ){
 789     printf("Derived from %.25s with changes to:\n", zVers);
 790   }
 791   printf("    %s\n", zFile);
 792   (*pnErr)++;
 793 }
 794 static void errorMsgNH(int *pnErr, const char *zVers, const char *zFile){
 795   if( *pnErr==0 ){
 796     printf("%s\n", zVers);
 797   }
 798   printf("%s\n", zFile);
 799   (*pnErr)++;
 800 }
 801
 802 int main(int argc, char **argv){
 803   int i, j;
 804   int nDir;
 805   FILE *in;
 806   int bDebug = 0;
 807   int bNonHuman = 0;
 808   int bSeenManifestErr = 0;
 809   int nErr = 0;
 810   SHA3Context ctx3;
 811   const char *zDir = 0;
 812   void (*xErr)(int*,const char*,const char*);
 813   char zHash[100];
 814   char zCk[100];
 815   char zVers[100];
 816   char zLine[40000];
 817   char zFile[40000];
 818   xErr = errorMsg;
 819   for(i=1; i<argc; i++){
 820     const char *z = argv[i];
 821     if( z[0]!='-' ){
 822       if( zDir!=0 ){
 823         fprintf(stderr, "bad argument: %s\n", z);
 824         return 1;
 825       }
 826       zDir = z;
 827       continue;
 828     }
 829     if( z[1]=='-' && z[2]!=0 ) z++;
 830     if( strcmp(argv[1],"-sha1")==0 ){
 831       /* For testing purposes, if the first argument is --sha1, then simply
 832       ** compute and print the SHA1 checksum of all subsequent arguments. */
 833       for(i++; i<argc; i++){
 834         sha1sum_file(argv[i], zHash);
 835         printf("%s  %s\n", zHash, argv[i]);
 836       }
 837       return 0;
 838     }
 839     if( strcmp(argv[1], "-sha3")==0 ){
 840       /* For testing purposes, if the first argument is --sha3, then simply
 841       ** compute and print the SHA3-256 checksum of all subsequent arguments. */
 842       for(i++; i<argc; i++){
 843         sha3sum_file(argv[i], zHash);
 844         printf("%s  %s\n", zHash, argv[i]);
 845       }
 846       return 0;
 847     }
 848     if( strcmp(z,"-v")==0 ){
 849       bDebug = 1;
 850       continue;
 851     }
 852     if( strcmp(z,"-x")==0 ){
 853       bNonHuman = 1;
 854       xErr = errorMsgNH;
 855       continue;
 856     }
 857     fprintf(stderr, "Usage: %s DIRECTORY\n"
 858                     "   or: %s --sha1 FILE ...\n"
 859                     "   or: %s --sha3 FILE ...\n",
 860       argv[0], argv[0], argv[0]);
 861     return 1;
 862   }
 863   if( strlen(zDir)>1000 ){
 864     fprintf(stderr, "Directory argument too big: [%s]\n", zDir);
 865     return 1;
 866   }
 867   nDir = (int)strlen(zDir);
 868   if( nDir<0 ){
 869     fprintf(stderr, "Directory argument too short.\n");
 870     return 1;
 871   }
 872   memcpy(zFile, zDir, nDir);
 873   if( zFile[nDir-1]!='/' ){
 874     zFile[nDir++] = '/';
 875   }
 876   memcpy(&zFile[nDir], "manifest", 9);
 877   if( bDebug ){
 878     printf("manifest file: [%s]\n", zFile);
 879   }
 880   in = fopen(zFile, "rb");
 881   if( in==0 ){
 882     fprintf(stderr, "missing manifest: \"%s\"\n", zFile);
 883     return 1;
 884   }
 885   SHA3Init(&ctx3, 256);
 886   while( fgets(zLine, sizeof(zLine), in) ){
 887     if( zLine[0]=='#' ) break;
 888     SHA3Update(&ctx3, (unsigned char*)zLine, (int)strlen(zLine));
 889   }
 890   DigestToBase16(SHA3Final(&ctx3), zVers, 32);
 891
 892   rewind(in);
 893   while( fgets(zLine, sizeof(zLine), in) ){
 894     if( zLine[0]!='F' ) continue;
 895     if( zLine[1]!=' ' ) continue;
 896     for(i=2, j=nDir; zLine[i]!=0 && zLine[i]!=' '; i++, j++){
 897       if( j<sizeof(zFile) ) zFile[j] = zLine[i];
 898     }
 899     if( j<sizeof(zFile) ) zFile[j] = 0;
 900     zFile[sizeof(zFile)-1] = 0;
 901     defossilize(&zFile[nDir]);
 902     if( zLine[i]!=' ' ){
 903       bSeenManifestErr = 1;
 904       continue;
 905     }
 906     for(i++, j=0; zLine[i]>='0' && zLine[i]<='f'; i++, j++){
 907       if( j<sizeof(zHash) ) zHash[j] = zLine[i];
 908     }
 909     if( j<sizeof(zHash) ) zHash[j] = 0;
 910     zHash[sizeof(zHash)-1] = 0;
 911     if( bDebug ){
 912       printf("%s %s\n", zFile, zHash);
 913     }
 914     if( access(zFile, R_OK)!=0 ){
 915       xErr(&nErr, zVers, &zFile[nDir]);
 916       continue;
 917     }
 918     if( strlen(zHash)==40 ){
 919       sha1sum_file(zFile, zCk);
 920       if( strcmp(zHash, zCk)!=0 ){
 921         xErr(&nErr, zVers, &zFile[nDir]);
 922       }
 923     }else if( strlen(zHash)==64 ){
 924       sha3sum_file(zFile, zCk);
 925       if( strcmp(zHash, zCk)!=0 ){
 926         xErr(&nErr, zVers, &zFile[nDir]);
 927       }
 928     }else{
 929       bSeenManifestErr = 1;
 930       xErr(&nErr, zVers, &zFile[nDir]);
 931     }
 932   }
 933   fclose(in);
 934   in = 0;
 935   if( bSeenManifestErr ) xErr(&nErr, zVers, "manifest");
 936   memcpy(&zFile[nDir], "manifest.uuid", 14);
 937   if( access(zFile, R_OK)!=0
 938    || (in = fopen(zFile,"rb"))==0
 939    || fgets(zLine, sizeof(zLine), in)==0
 940    || strlen(zLine)!=65
 941    || zLine[64]!='\n'
 942    || memcmp(zLine, zVers, 64)!=0
 943   ){
 944     xErr(&nErr, zVers, &zFile[nDir]);
 945   }
 946   if( in ) fclose(in);
 947
 948   if( bNonHuman ){
 949     if( nErr ) return 0;
 950     printf("%s\n", zVers);
 951   }else{
 952     if( nErr ) return nErr;
 953     printf("OK %.25s\n", zVers);
 954   }
 955   return 0;
 956 }