From 6383e468f1d5b281159cd46d800204a1aa718cd2 Mon Sep 17 00:00:00 2001
From: Simon Ruderich <simon@ruderich.org>
Date: Thu, 13 Jun 2019 08:25:09 +0200
Subject: [PATCH] nsscash: store and check hash of deployed files

The goal is to detect manual modifications of the deployed files. As we
store only the last modification in the state file and don't check the
deployed file itself, modifications go unnoticed.

An alternative would be to check the last modification time of the
deployed files. But a hash is safer as possible corruptions to the file
are detected as well.
---
 README   | 12 +++++++-----
 file.go  | 31 +++++++++++++++++++++++++++++++
 state.go |  5 +++++
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/README b/README
index 510ba33..d9c255f 100644
--- a/README
+++ b/README
@@ -24,8 +24,8 @@ Nsscash is very careful when deploying the changes:
   message and a non-zero exit status. This prevents hiding possibly important
   errors. In addition all files are fetched first and then deployed to try to
   prevent inconsistent state if only one file can be downloaded. The state
-  file (containing last file modifications) is only updated when all
-  operations were successful.
+  file (containing last file modification and content hash) is only updated
+  when all operations were successful.
 - To prevent unexpected permissions, `nsscash` does not create new files. The
   user must create them first and `nsscash` will then re-use the permissions
   and owner/group when updating the file (see examples below).
@@ -127,9 +127,11 @@ typical configuration looks like this:
 
 The following global keys are available:
 
-- `statepath`: Path to a JSON file which stores the last modification time of
-  each file; automatically updated by `nsscash`. Used to fetch data only when
-  something has changed to reduce the required traffic.
+- `statepath`: Path to a JSON file which stores the last modification time and
+  hash of each file; automatically updated by `nsscash`. Used to fetch data
+  only when something has changed to reduce the required traffic, via
+  `If-Modified-Since`. When the hash of a file has changed the download is
+  forced.
 
 Each `file` block describes a single file to download/write. The following
 keys are available:
diff --git a/file.go b/file.go
index b77cbb6..0857dd5 100644
--- a/file.go
+++ b/file.go
@@ -19,6 +19,8 @@ package main
 
 import (
 	"bytes"
+	"crypto/sha512"
+	"encoding/hex"
 	"fmt"
 	"io/ioutil"
 	"log"
@@ -26,6 +28,7 @@ import (
 	"os"
 	"path/filepath"
 	"syscall"
+	"time"
 
 	"github.com/pkg/errors"
 )
@@ -58,8 +61,34 @@ func handleFiles(cfg *Config, state *State) error {
 	return nil
 }
 
+func checksumFile(file *File) (string, error) {
+	x, err := ioutil.ReadFile(file.Path)
+	if err != nil {
+		return "", err
+	}
+	return checksumBytes(x), nil
+}
+
+func checksumBytes(x []byte) string {
+	h := sha512.New()
+	h.Write(x)
+	return hex.EncodeToString(h.Sum(nil))
+}
+
 func fetchFile(file *File, state *State) error {
 	t := state.LastModified[file.Url]
+
+	hash, err := checksumFile(file)
+	if err != nil {
+		// See below in deployFile() for the reason
+		return errors.Wrapf(err, "file.path %q must exist", file.Path)
+	}
+	if hash != state.Checksum[file.Url] {
+		log.Printf("%q -> %q: hash has changed", file.Url, file.Path)
+		var zero time.Time
+		t = zero // force download
+	}
+
 	status, body, err := fetchIfModified(file.Url, &t)
 	if err != nil {
 		return err
@@ -116,6 +145,8 @@ func fetchFile(file *File, state *State) error {
 	} else {
 		return fmt.Errorf("unsupported file type %v", file.Type)
 	}
+
+	state.Checksum[file.Url] = checksumBytes(file.body)
 	return nil
 }
 
diff --git a/state.go b/state.go
index fa8dccd..9b67d9a 100644
--- a/state.go
+++ b/state.go
@@ -26,7 +26,9 @@ import (
 )
 
 type State struct {
+	// Key is File.Url
 	LastModified map[string]time.Time
+	Checksum     map[string]string // SHA512 in hex
 }
 
 func LoadState(path string) (*State, error) {
@@ -49,6 +51,9 @@ func LoadState(path string) (*State, error) {
 	if state.LastModified == nil {
 		state.LastModified = make(map[string]time.Time)
 	}
+	if state.Checksum == nil {
+		state.Checksum = make(map[string]string)
+	}
 
 	return &state, nil
 }
-- 
2.43.2