Skip to content

rustbuild: Verify sha256 of downloaded nightlies #32902

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
alexcrichton opened this issue Apr 12, 2016 · 1 comment
Closed

rustbuild: Verify sha256 of downloaded nightlies #32902

alexcrichton opened this issue Apr 12, 2016 · 1 comment
Labels
E-easy Call for participation: Easy difficulty. Experience needed to fix: Not much. Good first issue. T-bootstrap Relevant to the bootstrap subteam: Rust's build system (x.py and src/bootstrap)

Comments

@alexcrichton
Copy link
Member

We should be validating our downloads for two reasons:

  1. Make sure that the file wasn't corrupted in transit by accident with something like a faulty proxy.
  2. Make sure the file itself wasn't tampered with.

To accomplish this let's do two things:

  • Check into the compiler Rust source the sha256 of what we should be downloading.
  • Check the sha256 of what we just downloaded against this value.

Unfortunately we can't do this in Rust just yet, we'll have to do it in Python or shell out to some system utility. If you've got some Python chops or would like to write a little python, should be a pretty easy bug to get started!

All downloads currently happen in src/bootstrap/bootstrap.py, so this'll just be modifying the relevant pieces there. Feel free to reach out to me if you have questions!
@alexcrichton alexcrichton added E-easy Call for participation: Easy difficulty. Experience needed to fix: Not much. Good first issue. T-bootstrap Relevant to the bootstrap subteam: Rust's build system (x.py and src/bootstrap) labels Apr 12, 2016
@caipre
Copy link
Contributor

caipre commented Apr 13, 2016

I can take this one as well.

@alexcrichton: The idea here is just to compare the sha256 of the downloaded tarball against the value recorded in the corresponding *.sha256 file from https://static.rust-lang.org, correct? Your first bullet point could be read as though you're suggesting that the hash be committed to the repo as part of the nightly build process.

@caipre caipre mentioned this issue Apr 13, 2016
Merged
Manishearth added a commit to Manishearth/rust that referenced this issue Apr 15, 2016
@Manishearth
Rollup merge of rust-lang#32926 - caipre:rustbuild-verify-download, r…
70601b8 
…=alexcrichton

rustbuild: Verify sha256 of downloaded tarballs

Here's a quick first pass at this.

I don't use Python often enough to claim that this is totally Pythonic. I've left off some (almost certainly unnecessary) error handling regarding opening and processing files. The whole tarball is read into memory to calculate the hash, but the file isn't *so* large so that should be fine. I don't care for the output from `raise RuntimeError`, but that's how `run()` does it so I'm following precedent.

Tested by manually changing the value of `expected`, and by modifying the tarball then forcing `rustc_out_of_date()`. Both cases tripped the error.

Closes rust-lang#32902
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
E-easy Call for participation: Easy difficulty. Experience needed to fix: Not much. Good first issue. T-bootstrap Relevant to the bootstrap subteam: Rust's build system (x.py and src/bootstrap)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@alexcrichton @caipre