This adds an optional `source-checksum` tag to ensure download integrity by checking the checksum. ## Features - It supports the following `source-type`s: - `source-type: tar` - `source-type: zip` - It supports the following checksums: - `md5` - `sha1` - `sha224` - `sha256` - `sha384` - `sha512` - You can use it in the following ways: - `source-checksum: HASH` - raw hash - `source-checksum: checksum.txt` - local file - `source-checksum: http(s)://example.com/checksum` - remote URL ## Failsafes It has the following failsafes to ensure the code always works as intended: - Special exception for a checksum that doesn't match - Raises an exception for a checksum that is invalid, or incompatible with the checksums supported ## Testing coverage I have the following testing in place: - Unit tests: - Testing of each checksum in raw form with a created file (tar/zip) that has a static checksum - Creation of a checksum file and checking the checksum with that local file - Pulling http://tsimonq2.net/misc/snapcraft-checksum-tar and http://tsimonq2.net/misc/snapcraft-checksum-zip respectively and checking the checksum of the static file with those - Checking for an invalid checksum - Integration tests: - Testing of each checksum in raw form with a created file (tar/zip) that has a static checksum in the `snapcraft.yaml` files for `simple-tar` and `simple-zip` ## Discrepancies between this specification and the source If you find any difference between the code in this PR and the specification above, please comment, as that wasn't intended.