Additional potential corruption when downloading packages

[yishaigalatzer]

See - NuGetArchive/NuGet3@0005387#diff-81ea29218a578d3a3f3492f0b1e45b32R122

The code writing the hash is not Atomic, so that hash can be corrupt.

The right code should

                             using (var sha512 = SHA512.Create())
                             {
                                 packageHash = Convert.ToBase64String(sha512.ComputeHash(nupkgStream));
                             }

-                            // Note: PackageRepository relies on the hash file being written out as the final operation as part of a package install
-                            // to assume a package was fully installed.
+                            // Note: PackageRepository relies on the hash file being written out as the
+                            // final operation as part of a package install to assume a package was fully installed.

                             // ==> Change here - Create temp file for hash, (see above code for temp file for nupkg)

                             File.WriteAllText(tempHashPath, packageHash);
                             File.Move(tempHashPath, hashPath);

[yishaigalatzer]

The good news is that this is a dormant bug, because nothing is currently looking at the hash, and if/when it does it will just replace the package.

[danliu]

PR submitted: NuGet/NuGet.Client#19