Explicitly check stored digest

[gocheese.git] / refresh.go

diff --git a/refresh.go b/refresh.go
index 59c8ceb9f5dd7c2b6288e27eb1d1cc0c9f6574e9..0138e7ddfbf6f93e29e13f318ee025064ac6b640 100644 (file)
--- a/refresh.go
+++ b/refresh.go
@@ -25,6 +25,7 @@ import (
        "crypto/sha512"
        "encoding/hex"
        "encoding/json"
+       "errors"
        "hash"
        "io"
        "io/ioutil"
@@ -427,6 +428,15 @@ func refreshDir(
                                http.Error(w, "digest mismatch", http.StatusBadGateway)
                                return false
                        }
+                       if digestStored, err := ioutil.ReadFile(path + "." + hashAlgo); err == nil &&
+                               bytes.Compare(digest, digestStored) != 0 {
+                               err = errors.New("stored digest mismatch")
+                               log.Println("error", r.RemoteAddr, "pypi", filename, err)
+                               os.Remove(dst.Name())
+                               dst.Close()
+                               http.Error(w, err.Error(), http.StatusInternalServerError)
+                               return false
+                       }
                        if !NoSync {
                                if err = dst.Sync(); err != nil {
                                        os.Remove(dst.Name())