Verify checksums

__tests__/installer.test.ts

@@ -34,35 +34,35 @@ const toolDir = path.join(__dirname, 'runner', 'tools')
 const tempDir = path.join(__dirname, 'runner', 'temp')
 const fixtureDir = path.join(__dirname, 'fixtures')
 
-process.env['RUNNER_TOOL_CACHE'] = toolDir;
-process.env['RUNNER_TEMP'] = tempDir;
+process.env['RUNNER_TOOL_CACHE'] = toolDir
+process.env['RUNNER_TEMP'] = tempDir
 
 import * as installer from '../src/installer'
 
 describe('version matching tests', () => {
     describe('specific versions', () => {
-        it('Doesn\'t change the version when given a valid semver version', async () => {
-            expect(await installer.getJuliaVersion([], '1.0.5')).toEqual('1.0.5')
-            expect(await installer.getJuliaVersion(['v1.0.5', 'v1.0.6'], '1.0.5')).toEqual('1.0.5')
-            expect(await installer.getJuliaVersion(['v1.0.4', 'v1.0.5'], '1.0.5')).toEqual('1.0.5')
-            expect(await installer.getJuliaVersion(['v1.0.4'], '1.0.5')).toEqual('1.0.5')
-            expect(await installer.getJuliaVersion([], '1.3.0-alpha')).toEqual('1.3.0-alpha')
-            expect(await installer.getJuliaVersion(['v1.2.0', 'v1.3.0-alpha', 'v1.3.0-rc1', 'v1.3.0'], '1.3.0-alpha')).toEqual('1.3.0-alpha')
-            expect(await installer.getJuliaVersion([], '1.3.0-rc2')).toEqual('1.3.0-rc2')
+        it('Doesn\'t change the version when given a valid semver version', () => {
+            expect(installer.getJuliaVersion([], '1.0.5')).toEqual('1.0.5')
+            expect(installer.getJuliaVersion(['v1.0.5', 'v1.0.6'], '1.0.5')).toEqual('1.0.5')
+            expect(installer.getJuliaVersion(['v1.0.4', 'v1.0.5'], '1.0.5')).toEqual('1.0.5')
+            expect(installer.getJuliaVersion(['v1.0.4'], '1.0.5')).toEqual('1.0.5')
+            expect(installer.getJuliaVersion([], '1.3.0-alpha')).toEqual('1.3.0-alpha')
+            expect(installer.getJuliaVersion(['v1.2.0', 'v1.3.0-alpha', 'v1.3.0-rc1', 'v1.3.0'], '1.3.0-alpha')).toEqual('1.3.0-alpha')
+            expect(installer.getJuliaVersion([], '1.3.0-rc2')).toEqual('1.3.0-rc2')
         })
 
-        it('Doesn\'t change the version when given `nightly`', async () => {
-            expect(await installer.getJuliaVersion([], 'nightly')).toEqual('nightly')
-            expect(await installer.getJuliaVersion(testVersions, 'nightly')).toEqual('nightly')
+        it('Doesn\'t change the version when given `nightly`', () => {
+            expect(installer.getJuliaVersion([], 'nightly')).toEqual('nightly')
+            expect(installer.getJuliaVersion(testVersions, 'nightly')).toEqual('nightly')
         })
     })
 
     describe('version ranges', () => {
-        it('Chooses the highest available version that matches the input', async () => {
-            expect(await installer.getJuliaVersion(testVersions, '1')).toEqual('1.2.0')
-            expect(await installer.getJuliaVersion(testVersions, '1.0')).toEqual('1.0.5')
-            expect(await installer.getJuliaVersion(testVersions, '^1.3.0-rc1')).toEqual('1.3.0-rc4')
-            expect(await installer.getJuliaVersion(testVersions, '^1.2.0-rc1')).toEqual('1.2.0')
+        it('Chooses the highest available version that matches the input', () => {
+            expect(installer.getJuliaVersion(testVersions, '1')).toEqual('1.2.0')
+            expect(installer.getJuliaVersion(testVersions, '1.0')).toEqual('1.0.5')
+            expect(installer.getJuliaVersion(testVersions, '^1.3.0-rc1')).toEqual('1.3.0-rc4')
+            expect(installer.getJuliaVersion(testVersions, '^1.2.0-rc1')).toEqual('1.2.0')
         })
     })
 
@@ -96,16 +96,16 @@ describe('installer tests', () => {
     describe('versions.json parsing', () => {
         // Instead of downloading versions.json, use fixtures/versions.json
         beforeEach(() => {
-            nock('https://julialang-s3.julialang.org')
-            .get('/bin/versions.json')
-            .replyWithFile(200, path.join(fixtureDir, 'versions.json'))
+            nock('https://julialang-s3.julialang.org').persist()
+                .get('/bin/versions.json')
+                .replyWithFile(200, path.join(fixtureDir, 'versions.json'))
         })
-    
+
         afterEach(() => {
             nock.cleanAll()
             nock.enableNetConnect()
         })
-    
+
         it('Extracts the list of available versions', async () => {
             expect(await (await installer.getJuliaVersions(await installer.getJuliaVersionInfo())).sort()).toEqual(testVersions.sort())
         })

src/installer.ts

@@ -2,6 +2,7 @@ import * as core from '@actions/core'
 import * as exec from '@actions/exec'
 import * as tc from '@actions/tool-cache'
 
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
@@ -23,6 +24,25 @@ const archMap = {
 const osPlat = os.platform() // possible values: win32 (Windows), linux (Linux), darwin (macOS)
 core.debug(`platform: ${osPlat}`)
 
+/**
+ * @returns The SHA256 checksum of a given file.
+ */
+async function calculateChecksum(file: string): Promise<string> {
+    const hash = crypto.createHash('sha256')
+    const input = fs.createReadStream(file)
+
+    return new Promise((resolve, reject) => {
+        input.on('data', (chunk) => {
+            hash.update(chunk)
+        })
+
+        input.on('end', () => {
+            const digest = hash.digest('hex')
+            digest ? resolve(digest) : reject(new Error(`Could not calculate checksum of file ${file}: digest was empty.`))
+        })
+    })
+}
+
 /**
  * @returns The content of the downloaded versions.json file as object.
  */
@@ -90,29 +110,48 @@ function getNightlyFileName(arch: string): string {
     return `julia-latest${versionExt}.${ext}`
 }
 
-export function getDownloadURL(versionInfo, version: string, arch: string): string {
-    // nightlies
+export function getFileInfo(versionInfo, version: string, arch: string) {
     if (version == 'nightly') {
-        const baseURL = 'https://julialangnightlies-s3.julialang.org/bin'
-        return `${baseURL}/${osMap[osPlat]}/${arch}/${getNightlyFileName(arch)}`
+        return null
     }
 
     for (let file of versionInfo[version].files) {
         if (file.os == osMap[osPlat] && file.arch == archMap[arch]) {
-            core.debug(file)
-            return file.url
+            return file
         }
     }
 
     throw `Could not find ${archMap[arch]}/${version} binaries`
 }
 
+export function getDownloadURL(fileInfo, version: string, arch: string): string {
+    // nightlies
+    if (version == 'nightly') {
+        const baseURL = 'https://julialangnightlies-s3.julialang.org/bin'
+        return `${baseURL}/${osMap[osPlat]}/${arch}/${getNightlyFileName(arch)}`
+    }
+
+    return fileInfo.url
+}
+
 export async function installJulia(versionInfo, version: string, arch: string): Promise<string> {
     // Download Julia
-    const downloadURL = getDownloadURL(versionInfo, version, arch)
+    const fileInfo = getFileInfo(versionInfo, version, arch)
+    const downloadURL = getDownloadURL(fileInfo, version, arch)
     core.debug(`downloading Julia from ${downloadURL}`)
     const juliaDownloadPath = await tc.downloadTool(downloadURL)
 
+    // Verify checksum
+    if (version != 'nightly') {
+        const checkSum = await calculateChecksum(juliaDownloadPath)
+        if (fileInfo.sha256 != checkSum) {
+            throw new Error(`Checksum of downloaded file does not match the expected checksum from versions.json.\nExpected: ${fileInfo.sha256}\nGot: ${checkSum}`)
+        }
+        core.debug(`Checksum of downloaded file matches expected checksum: ${checkSum}`)
+    } else {
+        core.debug('Skipping checksum check for nightly binaries.')
+    }
+
     const tempInstallDir = fs.mkdtempSync(`julia-${arch}-${version}-`)
 
     // Install it