Merge pull request #153 from ethereum/validate-release-hash

Validate release hash on download

Author: chriseth

downloadCurrentVersion.js

@@ -7,6 +7,7 @@ var pkg = require('./package.json');
 var fs = require('fs');
 var https = require('https');
 var MemoryStream = require('memorystream');
+var ethJSUtil = require('ethereumjs-util');
 
 function getVersionList (cb) {
   console.log('Retrieving available version list...');
@@ -24,10 +25,10 @@ function getVersionList (cb) {
   });
 }
 
-function downloadBinary (version) {
+function downloadBinary (outputName, version, expectedHash) {
   console.log('Downloading version', version);
 
-  var file = fs.createWriteStream('soljson.js');
+  var file = fs.createWriteStream(outputName, { encoding: 'binary' });
   https.get('https://ethereum.github.io/solc-bin/bin/' + version, function (response) {
     if (response.statusCode !== 200) {
       console.log('Error downloading file: ' + response.statusCode);
@@ -36,6 +37,11 @@ function downloadBinary (version) {
     response.pipe(file);
     file.on('finish', function () {
       file.close(function () {
+        var hash = '0x' + ethJSUtil.sha3(fs.readFileSync(outputName, { encoding: 'binary' })).toString('hex');
+        if (expectedHash !== hash) {
+          console.log('Hash mismatch: ' + expectedHash + ' vs ' + hash);
+          process.exit(1);
+        }
         console.log('Done.');
       });
     });
@@ -47,5 +53,7 @@ console.log('Downloading correct solidity binary...');
 getVersionList(function (list) {
   list = JSON.parse(list);
   var wanted = pkg.version.match(/^(\d+\.\d+\.\d+)$/)[1];
-  downloadBinary(list.releases[wanted]);
+  var releaseFileName = list.releases[wanted];
+  var expectedHash = list.builds.filter(function (entry) { return entry.path === releaseFileName; })[0].keccak256;
+  downloadBinary('soljson.js', releaseFileName, expectedHash);
 });

package.json

@@ -44,6 +44,7 @@
     "yargs": "^4.7.1"
   },
   "devDependencies": {
+    "ethereumjs-util": "^5.1.2",
     "semistandard": "^11.0.0",
     "tape": "^4.5.1",
     "tape-spawn": "^1.4.2"