sources: add optional "source-checksum" property
Metadata
Current evaluation
PR #980 merged as commit 3e9c4d381, adding the optional source-checksum property to verify integrity of tar, zip, deb and rpm sources, with algorithm/digest errors plus unit and integration tests.
Resolution: closed resolved
Reason: The pull request itself was merged into snapcraft's mainline as commit 3e9c4d381 ('sources: add optional "source-checksum" property (#980)'), which appears in the history of snapcraft/internal/sources/__init__.py. It resolves LP: #1585913 and implements the narrowed, file-based version of the earlier proposal in PR #619, which was closed.
Evaluated by: mr-cal-bot
No scores available.
Issue body
# Features
- Solution for [LP: #1585913](https://bugs.launchpad.net/snapcraft/+bug/1585913) bug based on work done by @tsimonq2 in PR #619 but with support only for checksums specified in the snapcraft.yml file.
- The code adds the optional property **"source-checksum"** to check the integrity of the source files (tar, zip, deb or rpm).
- The format of the property is **\<algorithm\>/\<digest\>**. For example:
- sha256/de2fb61252548af3c87c4aab17e82601691d19e37fd3d29ea6288e56
- Currently, the supported algorithms are: **md5**, **sha1**, **sha224**, **sha256**, **sha384**, **sha512**, **sha3_256**, **sha3_384** & **sha3_512**
- The sha3 support comes from [pysha3](https://pypi.python.org/pypi/pysha3) in systems where python version < 3.6.
- ~~The size of **sha2** digests is automatically detected, supporting the following bit sizes:~~
- ~~224~~
- ~~256~~
- ~~384~~
- ~~512~~
# Failsafes
- It has the following failsafes to ensure the code always works as intended:
- Special exception for a checksum that doesn't match
- Raises an exception for a checksum that is invalid, or incompatible with the checksums supported
# Testing coverage
- I have the following testing in place:
- Integration tests:
- Testing of each supported algorithm in raw form with a created file (tar) that has a static checksum in the snapcraft.yaml file.
- A single test in simple-zip.
- Tests deb-with-checksum and rpm-with-checksum created.
- Unit tests:
- Testing for sources that don't allow digest.
- Testing for sources that allow digest and where the digest:
- is correct
- is wrong
- uses an invalid algorithm
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | PR #980 merged as commit 3e9c4d381, adding the optional source-checksum property to verify integrity of tar, zip, deb and rpm sources, with algorithm/digest errors plus unit and integration tests. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #980 via commit 3e9c4d381, adding optional source-checksum validation for tar, zip, deb and rpm sources, with algorithm/digest error handling and tests. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged after CLA verification and conflict resolution. Adds an optional source-checksum property to verify source file integrity using multiple hash algorithms, accompanied by unit and integration tests. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged after test refactoring, CLA verification, and conflict resolution. Adds an optional source-checksum property to verify source file integrity using md5, sha1, sha256, and sha3 algorithms. |
Update history
No update history recorded yet.
Related work
-
Related To:
snapcraft#940
(confidence 45%)
Contributor referenced #940 (delta uploads / sha3 support); unclear overlap, but PR #980's checksum work cites it.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #26 sources: add support for source checksum | craft-parts | merged | Merged in #26 via bff37166, adding file checksum verification for the source-checksum part property. | |
| #619 Add source-checksum option | snapcraft | closed | Closed as inactive after review; source-checksum support was later delivered by merged PR #980 in commit 3e9c4d381. |