Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

dev: validate sha256 checksums from upstream when packaging #306

Merged
merged 1 commit into from
Jan 7, 2024
Merged

dev: validate sha256 checksums from upstream when packaging #306

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion rakelib/package.rake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,9 @@ end

TAILWINDCSS_RAILS_GEMSPEC = Bundler.load_gemspec("tailwindcss-rails.gemspec")

# prepend the download task before the Gem::PackageTask tasks
task :package => :download

gem_path = Gem::PackageTask.new(TAILWINDCSS_RAILS_GEMSPEC).define
desc "Build the ruby gem"
task "gem:ruby" => [gem_path]
Expand Down Expand Up @@ -110,7 +113,33 @@ Tailwindcss::Upstream::NATIVE_PLATFORMS.each do |platform, filename|
end
end

desc "Validate checksums for tailwindcss binaries"
task "check" => exepaths do
sha_filename = "sha256sums.txt"
sha_url = tailwindcss_download_url(sha_filename)
gemspec = TAILWINDCSS_RAILS_GEMSPEC

checksums = URI.open(sha_url).each_line.map do |line|
checksum, file = line.split
[File.basename(file), checksum]
end.to_h

Tailwindcss::Upstream::NATIVE_PLATFORMS.each do |platform, filename|
exedir = File.join(gemspec.bindir, platform) # "exe/x86_64-linux"
exepath = File.join(exedir, "tailwindcss") # "exe/x86_64-linux/tailwindcss"

local_sha256 = Digest::SHA256.file(exepath).hexdigest
remote_sha256 = checksums.fetch(filename)

if local_sha256 == remote_sha256
puts "Checksum OK for #{exepath} (#{local_sha256})"
else
abort "Checksum mismatch for #{exepath} (#{local_sha256} != #{remote_sha256})"
end
end
end

desc "Download all tailwindcss binaries"
task "download" => exepaths
task "download" => :check

CLOBBER.add(exepaths.map { |p| File.dirname(p) })