From: Michael Tremer <michael.tremer@ipfire.org>
Date: Sat, 8 Apr 2017 16:54:04 +0000 (+0200)
Subject: http: Compare retrieved files against a checksum
X-Git-Tag: 0.9.28~1285^2~1354
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7c7352ffe39e215fb4e8dfd83ecf2d1d1c1a6856;p=pakfire.git

http: Compare retrieved files against a checksum

If the checksum does not match, the file is redownloaded from
another mirror server until all mirrors have been tried.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/pakfire/http.py b/src/pakfire/http.py
index be4619320..7222cf5cb 100644
--- a/src/pakfire/http.py
+++ b/src/pakfire/http.py
@@ -20,6 +20,7 @@
 ###############################################################################
 
 import base64
+import hashlib
 import json
 import logging
 import shutil
@@ -296,7 +297,7 @@ class Client(object):
 
 		raise MaxTriesExceededError
 
-	def retrieve(self, url, filename=None, message=None, **kwargs):
+	def retrieve(self, url, filename=None, message=None, checksum=None, checksum_algo=None, **kwargs):
 		p = None
 		skipped_mirrors = []
 
@@ -329,17 +330,25 @@ class Client(object):
 								l = self._get_content_length(res)
 								p.value_max = l
 
+								# Compute a checksum of each downloaded file
+								h = hashlib.new(checksum_algo or "sha512")
+
 								while True:
 									buf = res.read(BUFFER_SIZE)
 									if not buf:
 										break
 
 									# Write downloaded data to file
+									h.update(buf)
 									f.write(buf)
 
 									l = len(buf)
 									p.increment(l)
 
+								# Check integrity of the downloaded file
+								if checksum and not checksum == h.hexdigest():
+									raise DownloadError(_("Invalid checksum"))
+
 								# If the download succeeded, we will
 								# break the loop
 								break