Merge pull request #33 from getsolus/checksum-check

builder/source: check the sha256sum matches when downloading

builder/source/simple.go

@@ -20,14 +20,15 @@ import (
 	"crypto/sha1"
 	"crypto/sha256"
 	"encoding/hex"
-	"github.com/cavaliergopher/grab/v3"
-	"github.com/cheggaaa/pb/v3"
 	"io/ioutil"
 	"net/url"
 	"os"
 	"path/filepath"
 	"time"
 
+	"github.com/cavaliergopher/grab/v3"
+	"github.com/cheggaaa/pb/v3"
+
 	log "github.com/DataDrake/waterlog"
 )
 
@@ -123,6 +124,15 @@ func (s *SimpleSource) download(destination string) error {
 		return err
 	}
 
+	// Ensure the checksum matches
+	if !s.legacy {
+		sum, err := hex.DecodeString(s.validator)
+		if err != nil {
+			return err
+		}
+		req.SetChecksum(sha256.New(), sum, false)
+	}
+
 	resp := grab.NewClient().Do(req)
 
 	// Setup our progress bar