Support a per-source integrity hash

`.src()` takes an optional 4th `hash` argument. It's forwarded to the
downloader, which verifies the download before extraction.

Author: XhmikosR

index.js

@@ -17,6 +17,7 @@ import osFilterObject from '@xhmikosr/os-filter-obj';
  * @property {string} url - The URL of the file.
  * @property {string} [os] - The operating system the file is for.
  * @property {string} [arch] - The architecture the file is for.
+ * @property {string} [hash] - Expected hash as `"<algorithm>:<hex>"`, verified after download.
  */
 
 export default class BinWrapper {
@@ -39,15 +40,21 @@ export default class BinWrapper {
 	 * @param {string} [src] - The source URL of the file.
 	 * @param {string} [os] - The operating system the file is for.
 	 * @param {string} [arch] - The architecture the file is for.
+	 * @param {string} [hash] - Expected hash as `"<algorithm>:<hex>"`, verified after download.
 	 * @returns {SourceFile[]|undefined|this} - Returns the source files if no arguments are provided, otherwise returns `this`.
 	 */
-	src(src, os, arch) {
+	src(src, os, arch, hash) {
 		if (arguments.length === 0) {
 			return this._src;
 		}
 
 		this._src ||= [];
-		this._src.push({url: src, os, arch});
+		this._src.push({
+			url: src,
+			os,
+			arch,
+			hash,
+		});
 
 		return this;
 	}
@@ -109,13 +116,22 @@ export default class BinWrapper {
 		return path.join(this.dest(), this.use());
 	}
 
+	/**
+	 * Filter the configured sources down to the ones matching the current OS and arch
+	 *
+	 * @returns {SourceFile[]}
+	 */
+	#resolveSources() {
+		return osFilterObject(this.src() || []);
+	}
+
 	/**
 	 * Get the source URLs matching the current OS and arch
 	 *
 	 * @returns {string[]}
 	 */
 	resolvedUrls() {
-		return osFilterObject(this.src() || []).map(file => file.url);
+		return this.#resolveSources().map(file => file.url);
 	}
 
 	/**
@@ -177,15 +193,16 @@ export default class BinWrapper {
 	 * @api private
 	 */
 	async download() {
-		const urls = this.resolvedUrls();
+		const sources = this.#resolveSources();
 
-		if (urls.length === 0) {
+		if (sources.length === 0) {
 			throw new Error('No binary found matching your system. It\'s probably not supported.');
 		}
 
-		const results = await Promise.all(urls.map(url =>
-			downloader(url, this.dest(), {
+		const results = await Promise.all(sources.map(source =>
+			downloader(source.url, this.dest(), {
 				extract: true,
+				hash: source.hash,
 				decompress: {
 					...this.options.decompress,
 					strip: this.options.strip,
@@ -197,7 +214,7 @@ export default class BinWrapper {
 				return item.map(file => file.path);
 			}
 
-			const parsedUrl = new URL(urls[index]);
+			const parsedUrl = new URL(sources[index].url);
 
 			return path.parse(parsedUrl.pathname).base;
 		});

package.json

@@ -57,6 +57,7 @@
 	},
 	"xo": {
 		"rules": {
+			"require-unicode-regexp": "off",
 			"unicorn/prevent-abbreviations": "off"
 		}
 	}

readme.md

@@ -71,7 +71,7 @@ Strip a number of leading paths from file names on extraction.
 Extra options forwarded to [`@xhmikosr/decompress`](https://github.com/XhmikosR/decompress) e.g. `plugins`.
 The `strip` key is ignored here; use the top-level `strip` option instead.
 
-### .src(url, [os], [arch])
+### .src(url, [os], [arch], [hash])
 
 Adds a source to download.
 
@@ -93,6 +93,17 @@ Type: `string`
 
 Tie the source to a specific arch.
 
+#### hash
+
+Type: `string`
+
+Expected `"<algorithm>:<hex>"` digest, verified against the download before extraction (see
+[`@xhmikosr/downloader`](https://github.com/XhmikosR/download#optionshash)).
+
+```js
+bin.src(`${base}/linux/x64/gifsicle`, 'linux', 'x64', 'sha256:9f86d0...');
+```
+
 ### .dest(destination)
 
 #### destination

test.js

@@ -1,3 +1,4 @@
+import {createHash} from 'node:crypto';
 import fs, {promises as fsP} from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
@@ -92,6 +93,32 @@ test('resolvedUrls returns empty when no source is set', t => {
 	t.deepEqual(new BinWrapper().resolvedUrls(), []);
 });
 
+test('download a source matching its hash', async t => {
+	const temporaryDir = temporaryDirectory();
+	const archive = await fsP.readFile(fixture(`gifsicle-${process.platform}.tar.gz`));
+	const hash = `sha256:${createHash('sha256').update(archive).digest('hex')}`;
+	const bin = new BinWrapper({skipCheck: true})
+		.src('http://foo.com/gifsicle.tar.gz', undefined, undefined, hash)
+		.dest(temporaryDir)
+		.use(binary);
+
+	await bin.run();
+	t.true(await pathExists(bin.path()));
+	await removeDir(temporaryDir);
+});
+
+test('throw when a source does not match its hash', async t => {
+	const temporaryDir = temporaryDirectory();
+	const wrongHash = `sha256:${'0'.repeat(64)}`;
+	const bin = new BinWrapper({skipCheck: true})
+		.src('http://foo.com/gifsicle.tar.gz', undefined, undefined, wrongHash)
+		.dest(temporaryDir)
+		.use(binary);
+
+	await t.throwsAsync(bin.run(), {message: /Hash mismatch/});
+	await removeDir(temporaryDir);
+});
+
 test('verify that a binary is working', async t => {
 	const temporaryDir = temporaryDirectory();
 	const bin = new BinWrapper()