download-and-verify-netboot.tar.gz

#!/bin/bash
set -euo pipefail

YOURMIRROR=mirror.mit.edu
DISTRO_VERSION=jessie
ARCH=amd64

pushd "$(mktemp -d /tmp/$(date -I).debian-installer-downloads.XXXXXXXXX)"
echo -n "Doing downloads in "
pwd

rm -f netboot.tar.gz
wget -q http://"$YOURMIRROR"/debian/dists/"$DISTRO_VERSION"/main/installer-"$ARCH"/current/images/netboot/netboot.tar.gz
wget -q http://"$YOURMIRROR"/debian/dists/"$DISTRO_VERSION"/main/installer-"$ARCH"/current/images/SHA256SUMS
wget -q http://"$YOURMIRROR"/debian/dists/"$DISTRO_VERSION"/Release
wget -q http://"$YOURMIRROR"/debian/dists/"$DISTRO_VERSION"/Release.gpg

echo "Making sure that the netboot.tar.gz validates against SHA256SUMS..."
echo ""
cat SHA256SUMS | grep -F netboot/netboot.tar.gz
grep -F $(sha256sum netboot.tar.gz | awk '{print $1}') SHA256SUMS
echo ""
echo "You should have seen two SHA256SUMs lines that are the same. If so, so far so good."

echo "Making sure the SHA256SUMS file verifies against the Release file."
echo ""
sha256sum SHA256SUMS
cat Release | grep -A 100000 '^SHA256' | grep -F installer-"$ARCH"/current/images/SHA256SUMS | grep -F "$(sha256sum SHA256SUMS | awk '{print $1}')" | sed 's/^ //'
echo ""
echo "You should have seen two SHA256SUMs lines that are the same. If so, so far so good."

echo "Making sure the Release file gpg-verifies against the Debian install key."
echo ""
gpg --no-default-keyring --keyring /usr/share/keyrings/debian-archive-keyring.gpg --verify Release.gpg Release
echo ""
echo 'Did you see: "Good signature made from....@debian.org? If so, congrats! You can trust this file'
echo "$PWD/netboot.tar.gz"