signalapp / gradle-witness

A gradle plugin that enables static verification for remote dependencies.
MIT License
229 stars 60 forks source link

SHA256 hashes dont match cli tools #12

Open Fuzion24 opened 9 years ago

Fuzion24 commented 9 years ago

This is a really nice idea here! However, it seems that the sha256 calculation performed by the plugin is different than want I'm getting from OSX's shasum tool

➜  Signal-Android git:(feature/share_location) ✗ find . -name "*.jar" | grep gcm
./build/intermediates/exploded-aar/com.google.android.gms/play-services-gcm/8.1.0/jars/classes.jar
➜  Signal-Android git:(feature/share_location) ✗ shasum -a 256 ./build/intermediates/exploded-aar/com.google.android.gms/play-services-gcm/8.1.0/jars/classes.jar
ef311fb0a50b9cb5db171f914fa7d714292173bb8d789fa46686191ce47aadb6  ./build/intermediates/exploded-aar/com.google.android.gms/play-services-gcm/8.1.0/jars/classes.jar
➜  Signal-Android git:(feature/share_location) ✗ gradle -q calculateChecksums | grep gcm
Verifying com.google.android.gms:play-services-gcm
        'com.google.android.gms:play-services-gcm:757ecd2c837ac81c98f4cc7dc783e7454c6d0506f6cc66b10417126b675248c9',
Fuzion24 commented 8 years ago

looked into this a bit further

sha256.groovy:

import java.security.MessageDigest

public class HelloWorld {

   public static main(args){
    if (args.size() < 0){
      println("Usage: groovy <script> <file-to-hash>")
      return;
    }
     println(calculateSha256(new File(args[0])))
   }
    static String calculateSha256(file) {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        file.eachByte 4096, {bytes, size ->
            md.update(bytes, 0, size);
        }
        return md.digest().collect {String.format "%02x", it}.join();
    }
}

It does appear that the sha256 is correct, maybe i was attempting to hash different jar files than what groovy was in the plugin:

➜  Downloads  groovy sha256.groovy ./209-timothy-c-may-the-cyphernomicon.pdf
a257016a9ddb41b24726bbafc5d3424d837218b6a11829587886b999727a2f1d
➜  Downloads  shasum -a 256 209-timothy-c-may-the-cyphernomicon.pdf
a257016a9ddb41b24726bbafc5d3424d837218b6a11829587886b999727a2f1d  209-timothy-c-may-the-cyphernomicon.pdf