Validate checkshum for downloaded files excluding git files #9
Conversation
Add checksum validation for downloaded archives. New field added to the `Source` struct. The checksum is calculated using the `sha256` algorithm and compared.
|
I know that this is still a draft, but why isn't the go hash package being used? It would work more reliable than using the host |
Modified the resolver to calculate the checksum of the downloaded. Instead of using the sha256sum command, the checksum is calculated in Go using the crypto/sha256 package.
|
Agree, I didn't know about the package but have used the command several times 😅. Shall I create a test for the function? In that case, do any recommendations for the URL I should use in the test? |
|
There is no reason to use the command line tool if the library works, it provides better portability and reduces the chance for issues to occur |
|
Yes, totally. Changes have been made, now it uses the standard library |
|
oh I did not see the commit adding that, sorry about that |
Add checksum validation for tar source downloads
|
I need to verify the checksum after closing the file because when I attempted to do so within the same function, the obtained checksum was incorrect |
|
Seems like I do not have permission to merge this pull request, cc @mirkobrombin for review and merge |
Modified the Source struct by adding a new field named Checksum of type string. This field will be validated using the sha256sum algorithm, provided it exists in the Source struct. If the checksum does not match, the DownloadTarSource function will now return an error.