From: Simon Ruderich Date: Thu, 13 Jun 2019 06:25:09 +0000 (+0200) Subject: nsscash: store and check hash of deployed files X-Git-Tag: 0.1~51 X-Git-Url: https://ruderich.org/simon/gitweb/?a=commitdiff_plain;h=6383e468f1d5b281159cd46d800204a1aa718cd2;p=nsscash%2Fnsscash.git nsscash: store and check hash of deployed files The goal is to detect manual modifications of the deployed files. As we store only the last modification in the state file and don't check the deployed file itself, modifications go unnoticed. An alternative would be to check the last modification time of the deployed files. But a hash is safer as possible corruptions to the file are detected as well. --- diff --git a/README b/README index 510ba33..d9c255f 100644 --- a/README +++ b/README @@ -24,8 +24,8 @@ Nsscash is very careful when deploying the changes: message and a non-zero exit status. This prevents hiding possibly important errors. In addition all files are fetched first and then deployed to try to prevent inconsistent state if only one file can be downloaded. The state - file (containing last file modifications) is only updated when all - operations were successful. + file (containing last file modification and content hash) is only updated + when all operations were successful. - To prevent unexpected permissions, `nsscash` does not create new files. The user must create them first and `nsscash` will then re-use the permissions and owner/group when updating the file (see examples below). @@ -127,9 +127,11 @@ typical configuration looks like this: The following global keys are available: -- `statepath`: Path to a JSON file which stores the last modification time of - each file; automatically updated by `nsscash`. Used to fetch data only when - something has changed to reduce the required traffic. +- `statepath`: Path to a JSON file which stores the last modification time and + hash of each file; automatically updated by `nsscash`. Used to fetch data + only when something has changed to reduce the required traffic, via + `If-Modified-Since`. When the hash of a file has changed the download is + forced. Each `file` block describes a single file to download/write. The following keys are available: diff --git a/file.go b/file.go index b77cbb6..0857dd5 100644 --- a/file.go +++ b/file.go @@ -19,6 +19,8 @@ package main import ( "bytes" + "crypto/sha512" + "encoding/hex" "fmt" "io/ioutil" "log" @@ -26,6 +28,7 @@ import ( "os" "path/filepath" "syscall" + "time" "github.com/pkg/errors" ) @@ -58,8 +61,34 @@ func handleFiles(cfg *Config, state *State) error { return nil } +func checksumFile(file *File) (string, error) { + x, err := ioutil.ReadFile(file.Path) + if err != nil { + return "", err + } + return checksumBytes(x), nil +} + +func checksumBytes(x []byte) string { + h := sha512.New() + h.Write(x) + return hex.EncodeToString(h.Sum(nil)) +} + func fetchFile(file *File, state *State) error { t := state.LastModified[file.Url] + + hash, err := checksumFile(file) + if err != nil { + // See below in deployFile() for the reason + return errors.Wrapf(err, "file.path %q must exist", file.Path) + } + if hash != state.Checksum[file.Url] { + log.Printf("%q -> %q: hash has changed", file.Url, file.Path) + var zero time.Time + t = zero // force download + } + status, body, err := fetchIfModified(file.Url, &t) if err != nil { return err @@ -116,6 +145,8 @@ func fetchFile(file *File, state *State) error { } else { return fmt.Errorf("unsupported file type %v", file.Type) } + + state.Checksum[file.Url] = checksumBytes(file.body) return nil } diff --git a/state.go b/state.go index fa8dccd..9b67d9a 100644 --- a/state.go +++ b/state.go @@ -26,7 +26,9 @@ import ( ) type State struct { + // Key is File.Url LastModified map[string]time.Time + Checksum map[string]string // SHA512 in hex } func LoadState(path string) (*State, error) { @@ -49,6 +51,9 @@ func LoadState(path string) (*State, error) { if state.LastModified == nil { state.LastModified = make(map[string]time.Time) } + if state.Checksum == nil { + state.Checksum = make(map[string]string) + } return &state, nil }