import * as crypto from 'crypto' ; import * as fs from 'fs' ; import * as path from 'path' ; import * as core from '@actions/core' ; import * as openpgp from 'openpgp' ; import * as fetch from 'node-fetch' ; import { getBaseUrl , getUploaderName , setFailure , } from './helpers' ; const verify = async ( filename , platform , version ) => { try { const uploaderName = getUploaderName ( platform ) ; const publicKeyArmored = await fs . readFileSync ( path . join ( __dirname , 'pgp_keys.asc' ) , 'utf-8' ) ; console . log ( `${ getBaseUrl ( platform , version ) }.SHA256SUM` ) ; const shasumRes = await fetch ( `${ getBaseUrl ( platform , version ) }.SHA256SUM` ) ; const shasum = await shasumRes . text ( ) ; const shaSigRes = await fetch ( `${ getBaseUrl ( platform , version ) }.SHA256SUM.sig` ) ; const shaSig = await shaSigRes . text ( ) ; const verified = await openpgp . verify ( { message : await openpgp . createMessage ( { text : shasum } ) , signature : await openpgp . readSignature ( { armoredSignature : shaSig } ) , verificationKeys : await openpgp . readKeys ( { armoredKeys : publicKeyArmored } ) , } ) ; const valid = await verified . signatures [ 0 ] . verified ; if ( valid ) { core . info ( '==> SHASUM file signed by key id ' + verified . signatures [ 0 ] . keyID . toHex ( ) ) ; } else { setFailure ( 'Codecov: Error validating SHASUM signature' , true ) ; } const calculateHash = async ( filename ) => { const stream = fs . createReadStream ( filename ) ; const uploaderSha = crypto . createHash ( `sha256` ) ; stream . pipe ( uploaderSha ) ; return new Promise ( ( resolve , reject ) => { stream . on ( 'end' , ( ) => resolve ( `${ uploaderSha . digest ( 'hex' ) }  ${ uploaderName }` ) ) ; stream . on ( 'error' , reject ) ; } ) ; } ; const hash = await calculateHash ( filename ) ; if ( hash === shasum ) { core . info ( `==> Uploader SHASUM verified (${ hash })` ) ; } else { setFailure ( 'Codecov: Uploader shasum does not match -- ' + `uploader hash: ${ hash }, public hash: ${ shasum }` , true ) ; } } catch ( err ) { setFailure ( `Codecov: Error validating uploader: ${ err . message }` , true ) ; } } ; export default verify ;