Implement sha256 option for Download build step tailhook#430

docs/build_steps.rst

@@ -434,6 +434,9 @@ Generic Commands
    mode
      (default '0o644') Mode (permissions) of the file. May be used to make
      executable bit enabled for downloaded script
+   sha256
+     (optional) Sha256 hashsum of the archive. If real hashsum is different this
+     step will fail.
 
    .. warning:: The download is cached similarly to other commands. Currently
       there is no way to control the caching. But it's common practice to

src/builder/commands/download.rs

@@ -4,7 +4,7 @@ use std::os::unix::fs::PermissionsExt;
 
 use quire::validate as V;
 use file_util::copy;
-use capsule::download::download_file;
+use capsule::download::maybe_download_and_check_hashsum;
 use build_step::{BuildStep, VersionError, StepError, Digest, Config, Guard};
 
 
@@ -13,6 +13,7 @@ pub struct Download {
     pub url: String,
     pub path: PathBuf,
     pub mode: u32,
+    pub sha256: Option<String>,
 }
 
 impl Download {
@@ -21,6 +22,7 @@ impl Download {
         .member("url", V::Scalar::new())
         .member("path", V::Directory::new().absolute(true))
         .member("mode", V::Numeric::new().default(0o644).min(0).max(0o1777))
+        .member("sha256", V::Scalar::new().optional())
     }
 }
 
@@ -30,7 +32,11 @@ impl BuildStep for Download {
     fn hash(&self, _cfg: &Config, hash: &mut Digest)
         -> Result<(), VersionError>
     {
-        hash.field("url", &self.url);
+        if let Some(ref sha) = self.sha256 {
+            hash.field("hash", sha);
+        } else {
+            hash.field("url", &self.url);
+        }
         hash.field("path", &self.path);
         hash.field("mode", self.mode);
         Ok(())
@@ -41,11 +47,8 @@ impl BuildStep for Download {
         if build {
             let fpath = PathBuf::from("/vagga/root")
                 .join(self.path.strip_prefix("/").unwrap());
-            let filename = if self.url.starts_with(".") {
-                PathBuf::from("/work").join(&self.url)
-            } else {
-                download_file(&mut guard.ctx.capsule, &[&self.url], None)?
-            };
+            let (filename, _) = maybe_download_and_check_hashsum(
+                &mut guard.ctx.capsule, &self.url, self.sha256.clone())?;
             copy(&filename, &fpath)
                 .map_err(|e| format!("Error copying {:?} to {:?}: {}",
                     &filename, self.path, e))?;

tests/generic.bats

@@ -276,7 +276,14 @@ setup() {
     printf "%s\n" "${lines[@]}"
     link=$(readlink .vagga/vagga)
     [[ ${lines[${#lines[@]}-1]} = 'v0.4.0' ]]
-    [[ $link = ".roots/vagga.557b6240/root" ]]
+    [[ $link = ".roots/vagga.03319fd2/root" ]]
+}
+
+@test "generic: download broken file" {
+    run vagga _build download-broken-file
+    printf "%s\n" "${lines[@]}"
+    [[ $status = 121 ]]
+    [[ $output = *"Hashsum mismatch"* ]]
 }
 
 @test "generic: tar without intermediate dirs" {

tests/generic/vagga.yaml

@@ -147,8 +147,6 @@ containers:
 
   vagga:
     setup:
-    - !Alpine v3.4
-    - !Install [wget]
     # Download file to workdir specifically
     - !Download
       url: http://files.zerogw.com/vagga/vagga-0.4.0.tar.xz
@@ -159,6 +157,13 @@ containers:
       subdir: vagga
       path: /usr/lib/vagga
 
+  download-broken-file:
+    setup:
+    - !Download
+      url: http://files.zerogw.com/vagga/vagga-0.4.0.tar.xz
+      path: /work/vagga-0.4.0.tar.xz
+      sha256: 0000000000000000000000000000000000000000000000000000000000000000
+
   tar-no-intermediate-dir:
     setup:
     - !Tar