empathicqubit/Signal-Android
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Run witness checksums in task and only when compiling.

Browse source
This commit is contained in:
Alan Evans 2020-12-04 12:32:17 -04:00 • committed by Greyson Parrelli
parent 898d92ba54
commit 67a3a30d4c
1 changed files with 58 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

95
buildSrc/src/main/groovy/org/whispersystems/witness/WitnessPlugin.groovy
View file

@ -15,62 +15,83 @@ class WitnessPluginExtension {
class WitnessPlugin implements Plugin<Project> { class WitnessPlugin implements Plugin<Project> {
static String calculateSha256(file) { static String calculateSha256(file) {
MessageDigest md = MessageDigest.getInstance("SHA-256"); MessageDigest md = MessageDigest.getInstance('SHA-256')
file.eachByte 4096, {bytes, size -> file.eachByte 4096, { bytes, size ->
md.update(bytes, 0, size); md.update(bytes, 0, size)
} }
return md.digest().collect {String.format "%02x", it}.join(); return md.digest().collect { String.format '%02x', it }.join()
} }
void apply(Project project) { void apply(Project project) {
project.extensions.create("dependencyVerification", WitnessPluginExtension) project.extensions.create('dependencyVerification', WitnessPluginExtension)
project.afterEvaluate { project.afterEvaluate {
project.dependencyVerification.verify.each { project.tasks
assertion -> .findAll { it.name =~ /compile/ }
List parts = assertion[0].tokenize(':') .each {
String group = parts.get(0) it.dependsOn('verifyChecksums')
String name = parts.get(1)
String hash = assertion[1]
def artifacts = allArtifacts(project).findAll {
return it.name.equals(name) && it.moduleVersion.id.group.equals(group)
} }
}
artifacts.forEach { dependency -> project.task('verifyChecksums') {
println "Verifying " + group + ":" + name group = 'Gradle Witness'
description = 'Verify the contents of dependencyVerification block in witness-verifications.gradle file(s) match the checksums of dependencies.'
if (dependency == null) { doLast {
throw new InvalidUserDataException("No dependency for integrity assertion found: " + group + ":" + name) def allArtifacts = allArtifacts(project)
project.dependencyVerification.verify.each {
assertion ->
List parts = assertion[0].tokenize(':')
String group = parts.get(0)
String name = parts.get(1)
String hash = assertion[1]
def artifacts = allArtifacts.findAll {
it.moduleVersion.id.group == group && it.name == name
} }
if (!hash.equals(calculateSha256(dependency.file))) { artifacts.forEach { dependency ->
throw new InvalidUserDataException("Checksum failed for " + assertion) println "Verifying $group:$name"
if (dependency == null) {
throw new InvalidUserDataException("No dependency for integrity assertion found: $group:$name")
}
if (hash != calculateSha256(dependency.file)) {
throw new InvalidUserDataException("Checksum failed for $assertion")
}
} }
} }
} }
} }
project.task('calculateChecksums').doLast { project.task('calculateChecksums') {
def stringBuilder = new StringBuilder() group = 'Gradle Witness'
description = 'Recalculate checksums of dependencies and update the witness-verifications.gradle file(s).'
stringBuilder.append '// Auto-generated, use ./gradlew calculateChecksums to regenerate\n\n' doLast {
stringBuilder.append 'dependencyVerification {\n' def stringBuilder = new StringBuilder()
stringBuilder.append ' verify = [\n' stringBuilder.append '// Auto-generated, use ./gradlew calculateChecksums to regenerate\n\n'
stringBuilder.append 'dependencyVerification {\n'
allArtifacts(project) stringBuilder.append ' verify = [\n'
.findAll { dep -> !dep.id.componentIdentifier.displayName.startsWith('project :') }
.collect { dep -> "['$dep.moduleVersion.id.group:$dep.name:$dep.moduleVersion.id.version',\n '${calculateSha256(dep.file)}']" }
.sort()
.unique()
.each {
dep -> stringBuilder.append "\n $dep,\n"
}
stringBuilder.append " ]\n" allArtifacts(project)
stringBuilder.append "}\n" .findAll { dep -> !dep.id.componentIdentifier.displayName.startsWith('project :') }
.collect { dep -> "['$dep.moduleVersion.id.group:$dep.name:$dep.moduleVersion.id.version',\n '${calculateSha256(dep.file)}']" }
.sort()
.unique()
.each {
dep -> stringBuilder.append "\n $dep,\n"
}
project.file("witness-verifications.gradle").write(stringBuilder.toString()) stringBuilder.append ' ]\n'
stringBuilder.append '}\n'
project.file('witness-verifications.gradle').write(stringBuilder.toString())
}
} }
} }