feat: add SHA256 verification for downloaded Perl releases #2114
Conversation
WalkthroughThe changes update the file download and verification process. In Changes
Sequence Diagram(s)sequenceDiagram
participant C as Client
participant A as acquirePerl
participant D as calculateDigest
participant F as File
C->>A: Request Perl download
A->>F: Download file
A->>A: Log "Starting download"
A->>D: Call calculateDigest(file)
D->>F: Read file stream incrementally
D-->>A: Return SHA256 digest
A->>A: Compare computed digest with expected sha256
alt Digest Matches
A->>C: Proceed with extraction and caching
else Digest Mismatch
A->>C: Throw error (checksum mismatch)
end
Poem
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
This PR adds SHA256 verification for downloaded Perl releases to improve security and integrity checks.
- Added a sha256 field to the PerlVersion interface.
- Inserted logging and digest verification in the acquirePerl function.
- Added a helper function, calculateDigest, to compute the SHA256 hash of a downloaded file.
Files not reviewed (1)
- versions/strawberry.json: Language not supported
Co-authored-by: Copilot <[email protected]>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
src/strawberry.ts (1)
131-140: Consider variable naming consistencyThe function is well implemented using streams for memory efficiency, but there's a minor naming inconsistency.
Consider renaming the return variable to better match its purpose:
async function calculateDigest(filename: string, algorithm: string): Promise<string> { - const hash = await new Promise<string>((resolve, reject) => { + const digest = await new Promise<string>((resolve, reject) => { const hash = crypto.createHash(algorithm); const stream = fs.createReadStream(filename); stream.on("data", (data) => hash.update(data)); stream.on("end", () => resolve(hash.digest("hex"))); stream.on("error", (err) => reject(err)); }); - return hash; + return digest; }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
dist/setup/index.jsis excluded by!**/dist/**dist/setup/index.js.mapis excluded by!**/dist/**,!**/*.map
📒 Files selected for processing (2)
src/strawberry.ts(3 hunks)versions/strawberry.json(1 hunks)
🔇 Additional comments (5)
src/strawberry.ts (4)
7-7: Good addition of the crypto moduleThe crypto module is correctly imported to handle SHA256 verification of downloaded Perl releases.
13-13: Well-defined interface updateAdding the
sha256property to thePerlVersioninterface is a clean way to support file integrity verification.
109-109: Good logging enhancementAdding informational logging about the download process improves observability.
112-116: Well-implemented verification logicThe SHA256 verification logic is well-implemented with proper error handling and case-insensitive comparison.
versions/strawberry.json (1)
5-5: SHA256 checksums properly addedSHA256 checksums have been consistently added to all Perl version entries, providing proper file integrity verification.
Also applies to: 10-10, 15-15, 20-20, 25-25, 30-30, 35-35, 40-40, 45-45, 50-50, 55-55, 60-60, 65-65, 70-70, 75-75, 80-80, 85-85, 90-90, 95-95, 100-100, 105-105, 110-110, 115-115, 120-120, 125-125, 130-130, 135-135, 140-140, 145-145, 150-150, 155-155, 160-160, 165-165, 170-170, 175-175, 180-180, 185-185, 190-190, 195-195, 200-200, 205-205
Summary by CodeRabbit