From ce87261c3c4c72fd5f1cef6ecb8b3f6f31e5bdf2 Mon Sep 17 00:00:00 2001 From: Jacob Date: Wed, 19 Aug 2026 11:45:20 +0200 Subject: [PATCH] fix: satisfy Chocolatey checksum validation --- .../chocolatey/tools/chocolateyInstall.ps1 | 10 +++-- .../powershell/ChocolateyPackaging.Tests.ps1 | 37 +++++++++++++++++++ 2 files changed, 44 insertions(+), 3 deletions(-) diff --git a/packaging/chocolatey/tools/chocolateyInstall.ps1 b/packaging/chocolatey/tools/chocolateyInstall.ps1 index 59cda82..88b66cb 100644 --- a/packaging/chocolatey/tools/chocolateyInstall.ps1 +++ b/packaging/chocolatey/tools/chocolateyInstall.ps1 @@ -20,9 +20,13 @@ $packageTools = Join-Path $packageRoot 'tools' $moduleRoot = Join-Path $packageTools 'DevNav' New-Item -ItemType Directory -Path $moduleRoot -Force | Out-Null -Get-ChocolateyWebFile -PackageName 'devnav' -FileFullPath (Join-Path $moduleRoot 'dev.exe') -Url $selected.dev.url -Checksum $selected.dev.sha256 -ChecksumType 'sha256' -Get-ChocolateyWebFile -PackageName 'devnav' -FileFullPath (Join-Path $moduleRoot 'DevNav.psm1') -Url $selected.module.url -Checksum $selected.module.sha256 -ChecksumType 'sha256' -Get-ChocolateyWebFile -PackageName 'devnav' -FileFullPath (Join-Path $moduleRoot 'DevNav.psd1') -Url $selected.manifest.url -Checksum $selected.manifest.sha256 -ChecksumType 'sha256' +if ($architecture -eq 'x64') { + Get-ChocolateyWebFile -PackageName 'devnav' -FileFullPath (Join-Path $moduleRoot 'dev.exe') -Url '__X64_DEV_URL__' -Checksum '__X64_DEV_SHA256__' -ChecksumType 'sha256' +} elseif ($architecture -eq 'arm64') { + Get-ChocolateyWebFile -PackageName 'devnav' -FileFullPath (Join-Path $moduleRoot 'dev.exe') -Url '__ARM64_DEV_URL__' -Checksum '__ARM64_DEV_SHA256__' -ChecksumType 'sha256' +} +Get-ChocolateyWebFile -PackageName 'devnav' -FileFullPath (Join-Path $moduleRoot 'DevNav.psm1') -Url '__MODULE_URL__' -Checksum '__MODULE_SHA256__' -ChecksumType 'sha256' +Get-ChocolateyWebFile -PackageName 'devnav' -FileFullPath (Join-Path $moduleRoot 'DevNav.psd1') -Url '__MANIFEST_URL__' -Checksum '__MANIFEST_SHA256__' -ChecksumType 'sha256' Assert-DevNavSha256 -Path (Join-Path $moduleRoot 'dev.exe') -Expected $selected.dev.sha256 Assert-DevNavSha256 -Path (Join-Path $moduleRoot 'DevNav.psm1') -Expected $selected.module.sha256 Assert-DevNavSha256 -Path (Join-Path $moduleRoot 'DevNav.psd1') -Expected $selected.manifest.sha256 diff --git a/tests/powershell/ChocolateyPackaging.Tests.ps1 b/tests/powershell/ChocolateyPackaging.Tests.ps1 index 8fe71cf..b948cdc 100644 --- a/tests/powershell/ChocolateyPackaging.Tests.ps1 +++ b/tests/powershell/ChocolateyPackaging.Tests.ps1 @@ -65,6 +65,43 @@ Describe 'Chocolatey package source contract' { finally { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue } } + It 'materializes a recognizable URL, SHA-256 and type on every download' { + $root = Join-Path ([IO.Path]::GetTempPath()) ('devnav-choco-cpmr0073-' + [guid]::NewGuid().ToString('N')) + New-Item -ItemType Directory -Path $root | Out-Null + try { + $manifest = [ordered]@{ + schemaVersion = 1 + version = '9.8.7' + artifacts = [ordered]@{ + 'binary-x64' = @{ file = 'dev-windows-x86_64.exe'; sha256 = ('a' * 64) } + 'binary-arm64' = @{ file = 'dev-windows-aarch64.exe'; sha256 = ('b' * 64) } + module = @{ file = 'DevNav.psm1'; sha256 = ('c' * 64) } + 'module-manifest' = @{ file = 'DevNav.psd1'; sha256 = ('d' * 64) } + } + } + $manifestPath = Join-Path $root 'release-manifest.json' + $manifest | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $manifestPath -Encoding utf8NoBOM + $output = Join-Path $root 'package' + & $script:materializerPath -Version '9.8.7' -ReleaseManifest $manifestPath -OutputDirectory $output | Out-Null + $install = Get-Content (Join-Path $output 'tools\chocolateyInstall.ps1') -Raw + $downloads = [regex]::Matches($install, '(?m)^\s*Get-ChocolateyWebFile\s+.+$') | + ForEach-Object { $_.Value.Trim() } + + $downloads.Count | Should -Be 4 + foreach ($download in $downloads) { + $download | Should -Match "-Url '[^']+'" + $download | Should -Match "-Checksum '[A-Fa-f0-9]{64}'" + $download | Should -Match "-ChecksumType 'sha256'" + $download | Should -Not -Match '\$selected\.' + } + ($downloads -join "`n") | Should -Match "dev-windows-x86_64\.exe'.*-Checksum 'a{64}'" + ($downloads -join "`n") | Should -Match "dev-windows-aarch64\.exe'.*-Checksum 'b{64}'" + ($downloads -join "`n") | Should -Match "DevNav\.psm1'.*-Checksum 'c{64}'" + ($downloads -join "`n") | Should -Match "DevNav\.psd1'.*-Checksum 'd{64}'" + } + finally { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction SilentlyContinue } + } + It 'rejects a tampered file checksum' { $path = Join-Path ([IO.Path]::GetTempPath()) ('devnav-choco-tamper-' + [guid]::NewGuid().ToString('N')) 'original' | Set-Content -LiteralPath $path -NoNewline