chore: implement download-tool.sh script (#957)

This script is in charge of downloading any asset from the internet
required by the build system. It accepts a SHA256 checksum and it uses
it to ensure the downloaded file integrity.

Signed-off-by: Juan Cruz Viotti <jviotti@openmailbox.org>

scripts/build/download-tool.sh

@@ -0,0 +1,99 @@
+#!/bin/bash
+
+###
+# Copyright 2016 resin.io
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+###
+
+set -u
+set -e
+
+function check_dep() {
+  if ! command -v $1 2>/dev/null 1>&2; then
+    echo "Dependency missing: $1" 1>&2
+    exit 1
+  fi
+}
+
+check_dep wget
+
+if command -v sha256sum 2>/dev/null 1>&2; then
+  SHA256SUM=sha256sum
+elif command -v shasum 2>/dev/null 1>&2; then
+  SHA256SUM="shasum -a 256"
+else
+  echo "Dependency missing: sha256sum or shasum" 1>&2
+  exit 1
+fi
+
+function usage() {
+  echo "Usage: $0"
+  echo ""
+  echo "Options"
+  echo ""
+  echo "    -u <url>"
+  echo "    -c <sha256 checksum>"
+  echo "    -x set execute permissions"
+  echo "    -o <output>"
+  exit 1
+}
+
+ARGV_URL=""
+ARGV_CHECKSUM=""
+ARGV_EXECUTE_PERMISSIONS=false
+ARGV_OUTPUT=""
+
+while getopts ":u:c:o:x" option; do
+  case $option in
+    u) ARGV_URL="$OPTARG" ;;
+    c) ARGV_CHECKSUM="$OPTARG" ;;
+    x) ARGV_EXECUTE_PERMISSIONS=true ;;
+    o) ARGV_OUTPUT="$OPTARG" ;;
+    *) usage ;;
+  esac
+done
+
+if [ -z "$ARGV_URL" ] || \
+   [ -z "$ARGV_CHECKSUM" ] || \
+   [ -z "$ARGV_OUTPUT" ]
+then
+  usage
+fi
+
+function checksum_matches() {
+  local file=$1
+  local hash=$2
+	test "$($SHA256SUM $file | cut -d ' ' -f1)" = "$hash"
+}
+
+if [ -e "$ARGV_OUTPUT" ]; then
+  if checksum_matches "$ARGV_OUTPUT" "$ARGV_CHECKSUM"; then
+    echo "Re-using from cache"
+    exit 0
+  else
+    rm "$ARGV_OUTPUT"
+  fi
+fi
+
+wget --no-check-certificate "$ARGV_URL" -O "$ARGV_OUTPUT"
+
+if ! checksum_matches "$ARGV_OUTPUT" "$ARGV_CHECKSUM"; then
+  echo "Checksum mismatch" 1>&2
+  rm -f "$ARGV_OUTPUT"
+  exit 1
+fi
+
+if [ "$ARGV_EXECUTE_PERMISSIONS" == "true" ]; then
+  chmod +x "$ARGV_OUTPUT"
+fi

scripts/build/electron-download-package.sh

@@ -69,7 +69,12 @@ if [ "$ELECTRON_ARCHITECTURE" == "x86" ]; then
 fi
 
 ELECTRON_GITHUB_REPOSITORY=https://github.com/electron/electron
+ELECTRON_DOWNLOADS_BASEURL="$ELECTRON_GITHUB_REPOSITORY/releases/download/v$ARGV_ELECTRON_VERSION"
 ELECTRON_FILENAME="electron-v$ARGV_ELECTRON_VERSION-$ARGV_OPERATING_SYSTEM-$ELECTRON_ARCHITECTURE.zip"
+ELECTRON_CHECKSUM=$(wget --no-check-certificate -O - "$ELECTRON_DOWNLOADS_BASEURL/SHASUMS256.txt" | grep "$ELECTRON_FILENAME" | cut -d ' ' -f 1)
 
 mkdir -p $(dirname $ARGV_OUTPUT)
-wget --no-check-certificate "$ELECTRON_GITHUB_REPOSITORY/releases/download/v$ARGV_ELECTRON_VERSION/$ELECTRON_FILENAME" -O "$ARGV_OUTPUT"
+./scripts/build/download-tool.sh \
+  -u "$ELECTRON_DOWNLOADS_BASEURL/$ELECTRON_FILENAME" \
+  -c "$ELECTRON_CHECKSUM" \
+  -o "$ARGV_OUTPUT"

scripts/build/electron-installer-appimage-linux.sh

@@ -83,25 +83,6 @@ then
   usage
 fi
 
-function download_executable() {
-  local url=$1
-  local output=$2
-  wget "$url" -O "$output"
-  chmod +x "$output"
-}
-
-APPIMAGES_TAG=6
-APPIMAGES_GITHUB_RELEASE_BASE_URL=https://github.com/probonopd/AppImageKit/releases/download/$APPIMAGES_TAG
-
-if [ "$ARGV_ARCHITECTURE" == "x64" ]; then
-  APPIMAGES_ARCHITECTURE="x86_64"
-elif [ "$ARGV_ARCHITECTURE" == "x86" ]; then
-  APPIMAGES_ARCHITECTURE="i686"
-else
-  echo "Invalid architecture: $ARGV_ARCHITECTURE" 1>&2
-  exit 1
-fi
-
 if [ -z "$TMPDIR" ]; then
   TMPDIR=$(mktemp -d)
 fi
@@ -114,9 +95,6 @@ APPDIR_PATH=$TMPDIR/${OUTPUT_FILENAME%.*}.AppDir
 APPDIR_ICON_FILENAME=icon
 rm -rf "$APPDIR_PATH"
 mkdir -p "$APPDIR_PATH/usr/bin"
-download_executable \
-  "$APPIMAGES_GITHUB_RELEASE_BASE_URL/AppRun_$APPIMAGES_TAG-$APPIMAGES_ARCHITECTURE" \
-  "$APPDIR_PATH/AppRun"
 
 cat >"$APPDIR_PATH/$ARGV_APPLICATION_NAME.desktop" <<EOF
 [Desktop Entry]
@@ -129,9 +107,6 @@ EOF
 
 cp "$ARGV_ICON" "$APPDIR_PATH/$APPDIR_ICON_FILENAME.png"
 cp -rf "$ARGV_PACKAGE"/* "$APPDIR_PATH/usr/bin"
-download_executable \
-  "https://raw.githubusercontent.com/probonopd/AppImageKit/$APPIMAGES_TAG/desktopintegration" \
-  "$APPDIR_PATH/usr/bin/$ARGV_BINARY.wrapper"
 
 # Compress binaries
 upx -9 "$APPDIR_PATH/usr/bin/$ARGV_BINARY"
@@ -152,10 +127,37 @@ fi
 mkdir -p "$(dirname "$ARGV_OUTPUT")"
 rm -f "$ARGV_OUTPUT"
 
+APPIMAGES_TAG=6
+APPIMAGES_GITHUB_RELEASE_BASE_URL=https://github.com/probonopd/AppImageKit/releases/download/$APPIMAGES_TAG
 APPIMAGEASSISTANT_PATH=$TMPDIR/AppImageAssistant.AppImage
-download_executable \
+
-  "$APPIMAGES_GITHUB_RELEASE_BASE_URL/AppImageAssistant_$APPIMAGES_TAG-$APPIMAGES_ARCHITECTURE.AppImage" \
+./scripts/build/download-tool.sh -x \
-  $APPIMAGEASSISTANT_PATH
+  -u "https://raw.githubusercontent.com/probonopd/AppImageKit/$APPIMAGES_TAG/desktopintegration" \
+  -c "bf321258134fa1290b3b3c005332d2aa04ca241e65c21c16c0ab76e892ef6044" \
+  -o "$APPDIR_PATH/usr/bin/$ARGV_BINARY.wrapper"
+
+if [ "$ARGV_ARCHITECTURE" == "x64"  ]; then
+  APPIMAGES_ARCHITECTURE="x86_64"
+  APPRUN_CHECKSUM=28b9c59facd7d0211ef5d825cc00873324cc75163902c48e80e34bf314c910c4
+  APPIMAGEASSISTANT_CHECKSUM=e792fa6ba1dd81de6438844fde39aa12d6b6d15238154ec46baf01da1c92d59f
+elif [ "$ARGV_ARCHITECTURE" == "x86"  ]; then
+  APPIMAGES_ARCHITECTURE="i686"
+  APPRUN_CHECKSUM=44a56d8a654891030bab57cee4670550ed550f6c63aa7d82377a25828671088b
+  APPIMAGEASSISTANT_CHECKSUM=0faade0c009e703c221650e414f3b4ea8d03abbd8b9f1f065aef46156ee15dd0
+else
+  echo "Invalid architecture: $ARGV_ARCHITECTURE" 1>&2
+  exit 1
+fi
+
+./scripts/build/download-tool.sh -x \
+  -u "$APPIMAGES_GITHUB_RELEASE_BASE_URL/AppRun_$APPIMAGES_TAG-$APPIMAGES_ARCHITECTURE" \
+  -c "$APPRUN_CHECKSUM" \
+  -o "$APPDIR_PATH/AppRun"
+
+./scripts/build/download-tool.sh -x \
+  -u "$APPIMAGES_GITHUB_RELEASE_BASE_URL/AppImageAssistant_$APPIMAGES_TAG-$APPIMAGES_ARCHITECTURE.AppImage" \
+  -c "$APPIMAGEASSISTANT_CHECKSUM" \
+  -o "$APPIMAGEASSISTANT_PATH"
 
 $APPIMAGEASSISTANT_PATH "$APPDIR_PATH" "$(dirname "$ARGV_OUTPUT")/$OUTPUT_FILENAME"
 rm -rf "$APPDIR_PATH"

scripts/build/package-cli.sh

@@ -27,7 +27,6 @@ function check_dep() {
 }
 
 check_dep browserify
-check_dep wget
 check_dep rsync
 
 function usage() {
@@ -78,13 +77,36 @@ NODE_STATIC_ENTRY_POINT_VERSION=v1.0.0 # NodeJS v6
 NODE_STATIC_ENTRY_POINT_FILENAME="node-$ARGV_OPERATING_SYSTEM-$ARGV_ARCHITECTURE"
 NODE_STATIC_ENTRY_POINT_URL="$NODE_STATIC_ENTRY_POINT_REPOSITORY/releases/download/$NODE_STATIC_ENTRY_POINT_VERSION/$NODE_STATIC_ENTRY_POINT_FILENAME"
 
+if [ "$ARGV_OPERATING_SYSTEM" == "darwin" ]; then
+  NODE_STATIC_ENTRY_POINT_CHECKSUM=12509af741777a2c3688169272fbb01e66b5c0efae400a775770b71d7b62666c
+elif [ "$ARGV_OPERATING_SYSTEM" == "linux" ]; then
+  if [ "$ARGV_ARCHITECTURE" == "x64" ]; then
+    NODE_STATIC_ENTRY_POINT_CHECKSUM=c1735694c1cef2bd26e4c8dcc7e67d5ad61b16b347f1b06588a52cf1aa4432fd
+  fi
+  if [ "$ARGV_ARCHITECTURE" == "x86" ]; then
+    NODE_STATIC_ENTRY_POINT_CHECKSUM=49eeacc086df04bb3370b7c25afcf36b6e45083889ca438747ece3dd96602b8d
+  fi
+elif [ "$ARGV_OPERATING_SYSTEM" == "win32" ]; then
+  if [ "$ARGV_ARCHITECTURE" == "x64" ]; then
+    NODE_STATIC_ENTRY_POINT_CHECKSUM=60f167aa3389e86956c4ec3c44de7107b4dc9d634b26dbd5f08e14e85f32c2ea
+  fi
+  if [ "$ARGV_ARCHITECTURE" == "x86" ]; then
+    NODE_STATIC_ENTRY_POINT_CHECKSUM=19f07b2d89a727dc64dd4b4e74b7ee8f4464ddc908b63bd60506d471e2f9f602
+  fi
+else
+  echo "Unsupported operating system: $ARGV_OPERATING_SYSTEM" 1>&2
+  exit 1
+fi
+
 rm -rf "$ARGV_OUTPUT"
 mkdir -p "$ARGV_OUTPUT"
 
 browserify "$ARGV_ENTRY_POINT" --node --outfile "$ARGV_OUTPUT/index.js"
 BINARY_LOCATION="$ARGV_OUTPUT/$ARGV_APPLICATION_NAME"
-wget "$NODE_STATIC_ENTRY_POINT_URL" -O "$BINARY_LOCATION"
+./scripts/build/download-tool.sh -x \
-chmod +x "$BINARY_LOCATION"
+  -u "$NODE_STATIC_ENTRY_POINT_URL" \
+  -c "$NODE_STATIC_ENTRY_POINT_CHECKSUM" \
+  -o "$BINARY_LOCATION"
 
 rsync \
   --archive \