Initial commit

src/download/checksum/checksum.ts

@@ -0,0 +1,55 @@
+import * as fs from 'fs'
+import * as crypto from 'crypto'
+
+import * as core from '@actions/core'
+import {KNOWN_CHECKSUMS} from './known-checksums'
+import {Architecture, Platform} from '../../utils/platforms'
+
+export async function validateChecksum(
+  checkSum: string | undefined,
+  downloadPath: string,
+  arch: Architecture,
+  platform: Platform,
+  version: string
+): Promise<void> {
+  let isValid = true
+  if (checkSum !== undefined && checkSum !== '') {
+    isValid = await validateFileCheckSum(downloadPath, checkSum)
+  } else {
+    core.debug(`Checksum not provided. Checking known checksums.`)
+    const key = `${arch}-${platform}-${version}`
+    if (key in KNOWN_CHECKSUMS) {
+      const knownChecksum = KNOWN_CHECKSUMS[`${arch}-${platform}-${version}`]
+      core.debug(`Checking checksum for ${arch}-${platform}-${version}.`)
+      isValid = await validateFileCheckSum(downloadPath, knownChecksum)
+    } else {
+      core.debug(`No known checksum found for ${key}.`)
+    }
+  }
+
+  if (!isValid) {
+    throw new Error(`Checksum for ${downloadPath} did not match ${checkSum}.`)
+  }
+  core.debug(`Checksum for ${downloadPath} is valid.`)
+}
+
+async function validateFileCheckSum(
+  filePath: string,
+  expected: string
+): Promise<boolean> {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256')
+    const stream = fs.createReadStream(filePath)
+    stream.on('error', err => reject(err))
+    stream.on('data', chunk => hash.update(chunk))
+    stream.on('end', () => {
+      const actual = hash.digest('hex')
+      resolve(actual === expected)
+    })
+  })
+}
+
+export function isknownVersion(version: string): boolean {
+  const pattern = new RegExp(`^.*-.*-${version}$`)
+  return Object.keys(KNOWN_CHECKSUMS).some(key => pattern.test(key))
+}

src/download/checksum/update-known-checksums.ts

@@ -0,0 +1,39 @@
+import {promises as fs} from 'fs'
+import * as tc from '@actions/tool-cache'
+export async function updateChecksums(
+  filePath: string,
+  downloadUrls: string[]
+): Promise<void> {
+  await fs.rm(filePath)
+  await fs.appendFile(
+    filePath,
+    '// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: {[key: string]: string} = {\n'
+  )
+  let firstLine = true
+  for (const downloadUrl of downloadUrls) {
+    const content = await downloadAssetContent(downloadUrl)
+    const checksum = content.split(' ')[0].trim()
+    const key = getKey(downloadUrl)
+    if (!firstLine) {
+      await fs.appendFile(filePath, ',\n')
+    }
+    await fs.appendFile(filePath, `  '${key}':\n    '${checksum}'`)
+    firstLine = false
+  }
+  await fs.appendFile(filePath, '}\n')
+}
+
+function getKey(downloadUrl: string): string {
+  // https://github.com/astral-sh/uv/releases/download/0.3.2/uv-aarch64-apple-darwin.tar.gz.sha256
+  const parts = downloadUrl.split('/')
+  const fileName = parts[parts.length - 1]
+  const name = fileName.split('.')[0].split('uv-')[1]
+  const version = parts[parts.length - 2]
+  return `${name}-${version}`
+}
+
+async function downloadAssetContent(downloadUrl: string): Promise<string> {
+  const downloadPath = await tc.downloadTool(downloadUrl)
+  const content = await fs.readFile(downloadPath, 'utf8')
+  return content
+}