source: add no & require checksums flags

ocaml · May 30, 2023 · 3ba8350 · 3ba8350
1 parent 966a12a
commit 3ba8350
Show file tree

Hide file tree

Showing 4 changed files with 193 additions and 3 deletions.
diff --git a/src/client/opamCommands.ml b/src/client/opamCommands.ml
@@ -3574,8 +3574,27 @@ let source cli =
       "Choose package without consideration for \
        the current (or any other) switch (installed or pinned packages, etc.)"
   in
-  let source global_options atom dev_repo pin no_switch dir () =
+  let no_checksums =
+    mk_flag ~cli (cli_from cli2_2) ["no-checksums"]
+      "Do not verify the checksum of downloaded source.\
+       This is equivalent to setting $(b,\\$OPAMNOCHECKSUMS) to \"true\"."
+  in
+  let req_checksums =
+    mk_flag ~cli (cli_from cli2_2) ["require-checksums"]
+      "Enforce checksum verification befor downloading sources.\
+       This is equivalent to setting $(b,\\$OPAMREQUIRECHECKSUMS) to \"true\"."
+  in
+  let source global_options atom dev_repo pin no_switch dir
+      no_checksums req_checksums () =
     apply_global_options cli global_options;
+    let force_checksums =
+      if req_checksums then Some (Some true)
+      else if no_checksums then Some (Some false)
+      else None
+    in
+    OpamStd.Option.iter (fun force_checksums ->
+        OpamRepositoryConfig.update ~force_checksums ())
+      force_checksums;
     OpamGlobalState.with_ `Lock_none @@ fun gt ->
     let get_package_dir t =
       let nv =
@@ -3699,9 +3718,11 @@ let source cli =
       OpamSwitchState.drop
         (OpamClient.PIN.pin t nv.name ~version:nv.version target)
   in
-  mk_command  ~cli cli_original "source" ~doc ~man
+  mk_command ~cli cli_original "source" ~doc ~man
     Term.(const source
-          $global_options cli $atom $dev_repo $pin $no_switch $dir)
+          $global_options cli
+          $atom $dev_repo $pin $no_switch $dir
+          $no_checksums $req_checksums)
 
 (* LINT *)
 let lint_doc = "Checks and validate package description ('opam') files."

diff --git a/tests/reftests/extrafiles-field-checks.test b/tests/reftests/extrafiles-field-checks.test
@@ -196,6 +196,10 @@ Done.
 ### opam source good-md5
 Successfully extracted to ${BASEDIR}/good-md5.1
 ### test -f good-md5.1/p.patch
+### rm -r good-md5.1
+### opam source good-md5 --require-checksums
+Successfully extracted to ${BASEDIR}/good-md5.1
+### test -f good-md5.1/p.patch
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:2: good md5 & sha256
@@ -230,6 +234,10 @@ Done.
 ### opam source good-md5-good-sha256
 Successfully extracted to ${BASEDIR}/good-md5-good-sha256.1
 ### test -f good-md5-good-sha256.1/p.patch
+### rm -r good-md5-good-sha256.1
+### opam source good-md5-good-sha256 --require-checksums
+Successfully extracted to ${BASEDIR}/good-md5-good-sha256.1
+### test -f good-md5-good-sha256.1/p.patch
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:3: bad md5
@@ -278,6 +286,12 @@ Bad hash for   - ${BASEDIR}/OPAM/repo/default/packages/bad-md5/bad-md5.1/files/p
 ### opam source bad-md5 | '.n"' -> '"'
 [WARNING] Some errors extracting to ${BASEDIR}/bad-md5.1: Failure("Bad hash for   - ${BASEDIR}/OPAM/repo/default/packages/bad-md5/bad-md5.1/files/p.patch")
 
+### test -f bad-md5.1/p.patch
+# Return code 1 #
+### rm -r bad-md5.1
+### opam source bad-md5 --require-checksums
+[WARNING] Some errors extracting to ${BASEDIR}/bad-md5.1: Failure("Bad hash for   - ${BASEDIR}/OPAM/repo/default/packages/bad-md5/bad-md5.1/files/p.patch\n")
+
 ### test -f bad-md5.1/p.patch
 # Return code 1 #
 ### opam clean --download-cache
@@ -324,6 +338,11 @@ Bad hash for   - ${BASEDIR}/OPAM/repo/default/packages/good-md5-bad-sha256/good-
 ### opam source good-md5-bad-sha256 | '.n"' -> '"'
 [WARNING] Some errors extracting to ${BASEDIR}/good-md5-bad-sha256.1: Failure("Bad hash for   - ${BASEDIR}/OPAM/repo/default/packages/good-md5-bad-sha256/good-md5-bad-sha256.1/files/p.patch")
 
+### test -f good-md5-bad-sha256.1/p.patch
+### rm -r good-md5-bad-sha256.1
+### opam source good-md5-bad-sha256 --require-checksums
+[WARNING] Some errors extracting to ${BASEDIR}/good-md5-bad-sha256.1: Failure("Bad hash for   - ${BASEDIR}/OPAM/repo/default/packages/good-md5-bad-sha256/good-md5-bad-sha256.1/files/p.patch\n")
+
 ### test -f good-md5-bad-sha256.1/p.patch
 ### opam clean --download-cache
 Clearing cache of downloaded files
@@ -376,6 +395,10 @@ Done.
 ### opam source no-checksum
 Successfully extracted to ${BASEDIR}/no-checksum.1
 ### test -f no-checksum.1/p.patch
+### rm -r no-checksum.1
+### opam source no-checksum --require-checksums
+Successfully extracted to ${BASEDIR}/no-checksum.1
+### test -f no-checksum.1/p.patch
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :::::::::::::::::
@@ -413,6 +436,10 @@ Done.
 ### opam source not-mentioned
 Successfully extracted to ${BASEDIR}/not-mentioned.1
 ### test -f not-mentioned.1/p.patch
+### rm -r not-mentioned.1
+### opam source not-mentioned --require-checksums
+Successfully extracted to ${BASEDIR}/not-mentioned.1
+### test -f not-mentioned.1/p.patch
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :II:2: not present

diff --git a/tests/reftests/extrasources-section-checks.test b/tests/reftests/extrasources-section-checks.test
@@ -399,6 +399,10 @@ Done.
 ### opam source good-sha256
 Successfully extracted to ${BASEDIR}/good-sha256.1
 ### test -f good-sha256.1/i-am-a-patch
+### rm -r good-sha256.1
+### opam source good-sha256 --require-checksums
+Successfully extracted to ${BASEDIR}/good-sha256.1
+### test -f good-sha256.1/i-am-a-patch
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:3: good md5 & sha256
@@ -451,6 +455,10 @@ Done.
 ### opam source good-md5-good-sha256
 Successfully extracted to ${BASEDIR}/good-md5-good-sha256.1
 ### test -f good-md5-good-sha256.1/i-am-a-patch
+### rm -r good-md5-good-sha256.1
+### opam source good-md5-good-sha256 --require-checksums
+Successfully extracted to ${BASEDIR}/good-md5-good-sha256.1
+### test -f good-md5-good-sha256.1/i-am-a-patch
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:4: good sha256 & good md5
@@ -502,6 +510,10 @@ Done.
 ### opam source good-sha256-good-md5
 Successfully extracted to ${BASEDIR}/good-sha256-good-md5.1
 ### test -f good-sha256-good-md5.1/i-am-a-patch
+### rm -r good-sha256-good-md5.1
+### opam source good-sha256-good-md5 --require-checksums
+Successfully extracted to ${BASEDIR}/good-sha256-good-md5.1
+### test -f good-sha256-good-md5.1/i-am-a-patch
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:5: no checksum
@@ -546,6 +558,12 @@ no-checksum.1/i-am-a-patch: Missing checksum, and `--require-checksums` was set.
 ### opam source no-checksum
 Successfully extracted to ${BASEDIR}/no-checksum.1
 ### test -f no-checksum.1/i-am-a-patch
+### rm -r no-checksum.1
+### opam source no-checksum --require-checksums
+[WARNING] Some errors extracting to ${BASEDIR}/no-checksum.1: Failure("no-checksum.1/i-am-a-patch: Missing checksum, and `--require-checksums` was set.")
+
+### test -f no-checksum.1/i-am-a-patch
+# Return code 1 #
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:6: multiple md5
@@ -601,6 +619,14 @@ OpamSolution.Fetch_fail("Checksum mismatch")
 # Return code 40 #
 ### test -f multiple-md5.1/i-am-a-patch
 # Return code 1 #
+### opam source multiple-md5 --require-checksums | '[0-9a-z]{32}' -> 'hash'
+[ERROR] multiple-md5.1/i-am-a-patch: Checksum mismatch for file://${BASEDIR}/p.patch:
+          expected md5=hash
+          got      md5=hash
+[ERROR] Download failed: Checksum mismatch
+# Return code 40 #
+### test -f multiple-md5.1/i-am-a-patch
+# Return code 1 #
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:7: bad md5
@@ -656,6 +682,14 @@ OpamSolution.Fetch_fail("Checksum mismatch")
 # Return code 40 #
 ### test -f bad-md5.1/i-am-a-patch
 # Return code 1 #
+### opam source bad-md5 --require-checksums | '[0-9a-z]{32}' -> 'hash'
+[ERROR] bad-md5.1/i-am-a-patch: Checksum mismatch for file://${BASEDIR}/p.patch:
+          expected md5=hash
+          got      md5=hash
+[ERROR] Download failed: Checksum mismatch
+# Return code 40 #
+### test -f bad-md5.1/i-am-a-patch
+# Return code 1 #
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:8: good md5 & bad sha256
@@ -781,6 +815,14 @@ OpamSolution.Fetch_fail("Checksum mismatch")
 # Return code 40 #
 ### test -f good-md5-bad-sha256.1/i-am-a-patch
 # Return code 1 #
+### opam source good-md5-bad-sha256 --require-checksums | '[0-9a-z]{64}' -> 'md5'
+[ERROR] good-md5-bad-sha256.1/i-am-a-patch: Checksum mismatch for file://${BASEDIR}/p.patch:
+          expected sha256=md5
+          got      sha256=md5
+[ERROR] Download failed: Checksum mismatch
+# Return code 40 #
+### test -f good-md5-bad-sha256.1/i-am-a-patch
+# Return code 1 #
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:9: good sha256 & bad md5
@@ -836,6 +878,14 @@ OpamSolution.Fetch_fail("Checksum mismatch")
 # Return code 40 #
 ### test -f good-sha256-bad-md5.1/i-am-a-patch
 # Return code 1 #
+### opam source good-sha256-bad-md5 --require-checksums | '[0-9a-z]{32}' -> 'hash'
+[ERROR] good-sha256-bad-md5.1/i-am-a-patch: Checksum mismatch for file://${BASEDIR}/p.patch:
+          expected md5=hash
+          got      md5=hash
+[ERROR] Download failed: Checksum mismatch
+# Return code 40 #
+### test -f good-sha256-bad-md5.1/i-am-a-patch
+# Return code 1 #
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :I:10: clash with all md5
@@ -960,6 +1010,14 @@ OpamSolution.Fetch_fail("Checksum mismatch")
 # Return code 40 #
 ### test -f clash-with-all-md5s.666/i-am-a-patch
 # Return code 1 #
+### opam source clash-with-all-md5s --require-checksums | '[0-9a-z]{32}' -> 'hash'
+[ERROR] clash-with-all-md5s.666/i-am-a-patch: Checksum mismatch for file://${BASEDIR}/p.patch:
+          expected md5=hash
+          got      md5=hash
+[ERROR] Download failed: Checksum mismatch
+# Return code 40 #
+### test -f clash-with-all-md5s.666/i-am-a-patch
+# Return code 1 #
 ### opam clean --download-cache
 Clearing cache of downloaded files
 ### :::::::::::::::::
@@ -1012,6 +1070,11 @@ The following actions will be performed:
 Successfully extracted to ${BASEDIR}/not-mentioned.1
 ### test -f not-mentioned.1/i-am-a-patch
 # Return code 1 #
+### rm -r not-mentioned.1
+### opam source not-mentioned --require-checksums
+Successfully extracted to ${BASEDIR}/not-mentioned.1
+### test -f not-mentioned.1/i-am-a-patch
+# Return code 1 #
 ### :II:2: Double extra-source
 ### opam lint --package multiple
 <default>/multiple.1: Errors.
@@ -1062,6 +1125,10 @@ Done.
 ### opam source multiple
 Successfully extracted to ${BASEDIR}/multiple.1
 ### test -f multiple.1/i-am-a-patch
+### rm -r multiple.1
+### opam source multiple --require-checksums
+Successfully extracted to ${BASEDIR}/multiple.1
+### test -f multiple.1/i-am-a-patch
 ### :::::::::::::::::
 ### :III: Cache manipulation
 ### :::::::::::::::::
@@ -1243,6 +1310,10 @@ Done.
 ### opam source escape-absolute
 Successfully extracted to ${BASEDIR}/escape-absolute.1
 ### test -f escape-absolute.1/etc/passwd
+### rm -r escape-absolute.1
+### opam source escape-absolute --require-checksums
+Successfully extracted to ${BASEDIR}/escape-absolute.1
+### test -f escape-absolute.1/etc/passwd
 ### :IV:2: good md5
 ### # /!\ all escape!!!
 ### opam lint --package escape-build-good-md5
@@ -1282,3 +1353,7 @@ Done.
 ### opam source escape-source-good-md5
 Successfully extracted to ${BASEDIR}/escape-source-good-md5.1
 ### test -f shouldnt-exist
+### rm -r escape-source-good-md5.1
+### opam source escape-source-good-md5 --require-checksums
+Successfully extracted to ${BASEDIR}/escape-source-good-md5.1
+### test -f shouldnt-exist