@@ -33,6 +33,12 @@
control system or compression algorithm. The source-type key can tell
snapcraft exactly how to treat that content.
+ - source-checksum: checksum-of-file
+
+ Snapcraft will use either a file, URL, or raw checksum specified here to
+ verify the integrity of the source. The source-type needs to be either tar
+ or zip.
+
- source-branch: <branch-name>
Snapcraft will checkout a specific branch from the source tree. This
@@ -70,13 +76,14 @@
import subprocess
import tempfile
import zipfile
+import hashlib
+import urllib
import glob
from snapcraft.internal import common
from snapcraft.internal.indicators import download_requests_stream
-
-logging.getLogger(' urllib3' CRITICAL )
+logging.getLogger(' urllib' CRITICAL )
class IncompatibleOptionsError (Exception ):
@@ -85,11 +92,18 @@ def __init__(self, message):
self .message = message
+class ChecksumDoesNotMatch (Exception ):
+
+ def __init__ (self message ):
+ self .message = message
+
+
class Base :
- def __init__ (self source , source_dir , source_tag = None ,
- source_branch = None ):
+ def __init__ (self source , source_dir , source_checksum = None ,
+ source_tag = None , source_branch = None ):
self .source = source
+ self .source_checksum = source_checksum
self .source_dir = source_dir
self .source_tag = source_tag
self .source_branch = source_branch
@@ -128,12 +142,16 @@ def download(self):
class Bazaar (Base ):
- def __init__ (self source , source_dir , source_tag = None ,
- source_branch = None ):
- super ().__init__ (source, source_dir, source_tag, source_branch)
+ def __init__ (self source , source_dir , source_checksum = None ,
+ source_tag = None , source_branch = None ):
+ super ().__init__ (
+ source, source_dir, source_checksum, source_tag, source_branch)
if source_branch:
raise IncompatibleOptionsError(
' can\' t specify a source-branch for a bzr source'
+ elif source_checksum:
+ raise IncompatibleOptionsError(
+ ' can\' t specify a source-checksum for a bzr source'
def pull (self
tag_opts = []
@@ -152,13 +170,17 @@ def pull(self):
class Git (Base ):
- def __init__ (self source , source_dir , source_tag = None ,
- source_branch = None ):
- super ().__init__ (source, source_dir, source_tag, source_branch)
+ def __init__ (self source , source_dir , source_checksum = None ,
+ source_tag = None , source_branch = None ):
+ super ().__init__ (
+ source, source_dir, source_checksum, source_tag, source_branch)
if source_tag and source_branch:
raise IncompatibleOptionsError(
' can\' t specify both source-tag and source-branch for '
' a git source'
+ elif source_checksum:
+ raise IncompatibleOptionsError(
+ ' can\' t specify source-checksum for a git source'
def pull (self
if os.path.exists(os.path.join(self .source_dir, ' .git'
@@ -188,13 +210,17 @@ def pull(self):
class Mercurial (Base ):
- def __init__ (self source , source_dir , source_tag = None ,
- source_branch = None ):
- super ().__init__ (source, source_dir, source_tag, source_branch)
+ def __init__ (self source , source_dir , source_checksum = None ,
+ source_tag = None , source_branch = None ):
+ super ().__init__ (
+ source, source_dir, source_checksum, source_tag, source_branch)
if source_tag and source_branch:
raise IncompatibleOptionsError(
' can\' t specify both source-tag and source-branch for a '
' mercurial source'
+ elif source_checksum:
+ raise IncompatibleOptionsError(
+ ' can\' t specify source-checksum for a mercurial source'
def pull (self
if os.path.exists(os.path.join(self .source_dir, ' .hg'
@@ -215,9 +241,10 @@ def pull(self):
class Subversion (Base ):
- def __init__ (self source , source_dir , source_tag = None ,
- source_branch = None ):
- super ().__init__ (source, source_dir, source_tag, source_branch)
+ def __init__ (self source , source_dir , source_checksum = None ,
+ source_tag = None , source_branch = None ):
+ super ().__init__ (
+ source, source_dir, source_checksum, source_tag, source_branch)
if source_tag:
if source_branch:
raise IncompatibleOptionsError(
@@ -229,6 +256,9 @@ def __init__(self, source, source_dir, source_tag=None,
elif source_branch:
raise IncompatibleOptionsError(
" Can't specify source-branch for a Subversion source"
+ elif source_checksum:
+ raise IncompatibleOptionsError(
+ " Can't specify source-checksum for a Subversion source"
def pull (self
if os.path.exists(os.path.join(self .source_dir, ' .svn'
@@ -247,9 +277,10 @@ def pull(self):
class Tar (FileBase ):
- def __init__ (self source , source_dir , source_tag = None ,
- source_branch = None ):
- super ().__init__ (source, source_dir, source_tag, source_branch)
+ def __init__ (self source , source_dir , source_checksum = None ,
+ source_tag = None , source_branch = None ):
+ super ().__init__ (
+ source, source_dir, source_checksum, source_tag, source_branch)
if source_tag:
raise IncompatibleOptionsError(
' can\' t specify a source-tag for a tar source'
@@ -261,6 +292,9 @@ def provision(self, dst, clean_target=True, keep_tarball=False):
# TODO add unit tests.
tarball = os.path.join(self .source_dir, os.path.basename(self .source))
+ if self .source_checksum:
+ verify_checksum(self .source_checksum, tarball)
+
if clean_target:
tmp_tarball = tempfile.NamedTemporaryFile().name
shutil.move(tarball, tmp_tarball)
@@ -318,9 +352,10 @@ def _strip_prefix(self, common, member):
class Zip (FileBase ):
- def __init__ (self source , source_dir , source_tag = None ,
- source_branch = None ):
- super ().__init__ (source, source_dir, source_tag, source_branch)
+ def __init__ (self source , source_dir , source_checksum = None ,
+ source_tag = None , source_branch = None ):
+ super ().__init__ (source, source_dir, source_checksum,
+ source_tag, source_branch)
if source_tag:
raise IncompatibleOptionsError(
' can\' t specify a source-tag for a zip source'
@@ -331,6 +366,9 @@ def __init__(self, source, source_dir, source_tag=None,
def provision (self dst , clean_target = True , keep_zip = False ):
zip = os.path.join(self .source_dir, os.path.basename(self .source))
+ if self .source_checksum:
+ verify_checksum(self .source_checksum, zip )
+
if clean_target:
tmp_zip = tempfile.NamedTemporaryFile().name
shutil.move(zip , tmp_zip)
@@ -377,12 +415,13 @@ def get(sourcedir, builddir, options):
:param options: source options.
"""
source_type = getattr (options, ' source_type' None )
+ source_checksum = getattr (options, ' source_checksum' None )
source_tag = getattr (options, ' source_tag' None )
source_branch = getattr (options, ' source_branch' None )
handler_class = _get_source_handler(source_type, options.source)
- handler = handler_class(options.source, sourcedir, source_tag ,
- source_branch)
+ handler = handler_class(options.source, sourcedir, source_checksum ,
+ source_tag, source_branch)
handler.pull()
@@ -456,3 +495,52 @@ def _get_source_type_from_uri(source, ignore_errors=False):
raise ValueError (' local source is not a directory'
return source_type
+
+
+def verify_checksum (source_checksum , checkfile ):
+ if source_checksum.startswith(' http'
+ response = urllib.request.urlopen(source_checksum)
+ data = response.read()
+ source_checksum = data.decode(' utf-8'
+ if (' ' in source_checksum):
+ source_checksum = source_checksum.split(' ' 1 )[0 ]
+ else :
+ print (' No file name detected in the checksum file, perhaps an '
+ ' invalid checksum file?'
+ if os.path.isfile(source_checksum):
+ filename = source_checksum
+ try :
+ filework = open (filename, ' r'
+ source_checksum = filework.read()
+ if (' ' in source_checksum):
+ source_checksum = source_checksum.split(' ' 1 )[0 ]
+ else :
+ print (' No file name detected in the checksum file, perhaps an '
+ ' invalid checksum file?'
+ finally :
+ filework.close()
+
+ _HASH_FUNCTIONS = {
+ 32 : hashlib.md5(),
+ 40 : hashlib.sha1(),
+ 56 : hashlib.sha224(),
+ 64 : hashlib.sha256(),
+ 96 : hashlib.sha384(),
+ 128 : hashlib.sha512()
+ }
+
+ try :
+ checksum = _HASH_FUNCTIONS [len (source_checksum)]
+ except KeyError :
+ raise IncompatibleOptionsError(' Invalid checksum format'
+
+ with open (checkfile, ' rb' as f:
+ for chunk in iter (lambda : f.read(4096 ), b ' '
+ checksum.update(chunk)
+
+ checksum = checksum.hexdigest()
+
+ if checksum != source_checksum:
+ raise ChecksumDoesNotMatch(
+ " the checksum ( {0} ) doesn't match the file ( {1} )"
+ source_checksum, checksum))
please use a different name than
zip,zipis a python keyword and it might get confusing.