just-mr: support additional hashes for fetched files

While git's (sha1-based) blob identifier is good for daily use and
strong enough to avoid accidental hash collisions (after all, we're
using git to version our sources), sha1 is no longer considered
safe enough to verify files downloaded through an unsecure channel.
Therefore, support additional checksum verification when obtaining
a file from the network.

1 files changed, 10 insertions, 0 deletions

diff --git a/bin/just-mr.py b/bin/just-mr.py
index 5c8109e3..1cb389c5 100755
--- a/bin/just-mr.py
+++ b/bin/just-mr.py
@@ -257,6 +257,16 @@ def archive_checkout(desc, repo_type="archive", *, fetch_only=False):
     if not is_in_cas(content_id):
         url = desc["fetch"]
         data = subprocess.run(["wget", "-O", "-", url], stdout=subprocess.PIPE).stdout
+        if "sha256" in desc:
+            actual_hash = hashlib.sha256(data).hexdigest()
+            if desc["sha256"] != actual_hash:
+                fail("SHA256 mismatch for %s, expected %s, found %s"
+                     % (url, desc["sha256"], actual_hash))
+        if "sha512" in desc:
+            actual_hash = hashlib.sha512(data).hexdigest()
+            if desc["sha512"] != actual_hash:
+                fail("SHA512 mismatch for %s, expected %s, found %s"
+                     % (url, desc["sha512"], actual_hash))
         add_to_cas(data)
         if not is_in_cas(content_id):
             fail("Failed to fetch a file with id %s from %s" % (content_id, url))