update get-pip to look for sha

Author: CaseyFaist

bin/steps/python

@@ -101,10 +101,17 @@ fi
 # https://github.com/pypa/get-pip
 GETPIP="https://lang-python.s3.amazonaws.com/etc/get-pip.py"
 
-if ! curl "${GETPIP}" -o "$ROOT_DIR/get-pip.py"; then
-    mcount "failure.python.get-pip"
-    echo "Failed to pull down get-pip"
-    exit 1
+# Grab SHA from get-pip
+CHECK_SHA="$(curl -s "$GETPIP" | sha256sum | cut -d ' ' -f 1)"
+
+# validate the sha is the same one we want
+if [ ! "$CHECK_SHA" == "$GETPIP_SHA" ]; then
+  mcount "failure.python.get-pip.wrong-sha"
+  echo "Incorrect SHA found"
+  exit 1
+else
+  curl "$GETPIP" -o "$ROOT_DIR/get-pip.py"
+  mcount "python.get-pip.install"
 fi
 
 # If Pip isn't up to date:
@@ -116,7 +123,7 @@ if [ "$FRESH_PYTHON" ] || [[ ! $(pip --version) == *$PIP_UPDATE* ]]; then
   rm -fr /app/.heroku/python/lib/python*/site-packages/pip-*
   rm -fr /app/.heroku/python/lib/python*/site-packages/setuptools-*
 
-  /app/.heroku/python/bin/python "$ROOT_DIR/get-pip.py" pip=="$PIP_UPDATE" &> /dev/null
+  /app/.heroku/python/bin/python "$ROOT_DIR/get-pip.py" pip=="$PIP_UPDATE" #&> /dev/null
   /app/.heroku/python/bin/pip install "$ROOT_DIR/vendor/setuptools-39.0.1-py2.py3-none-any.whl" &> /dev/null
 fi