Class: RuboCop::Cop::Chef::Correctness::InvalidChecksum

Inherits:
Base
  • Object
show all
Includes:
RuboCop::Chef::CookbookHelpers
Defined in:
lib/rubocop/cop/chef/correctness/invalid_checksum.rb

Overview

The checksum property of the file downloading resources is a SHA-256 digest. An MD5 or SHA-1 digest can never match, so the resource fails the run with a checksum mismatch rather than installing anything.

Only digests that are unambiguously the wrong algorithm are flagged: 32 character (MD5) and 40 character (SHA-1) hex strings. Anything else is left alone.

Examples:


# bad
remote_file '/tmp/foo.tar.gz' do
  source 'https://example.com/foo.tar.gz'
  checksum 'd41d8cd98f00b204e9800998ecf8427e'
end

# good
remote_file '/tmp/foo.tar.gz' do
  source 'https://example.com/foo.tar.gz'
  checksum 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
end

Constant Summary collapse

MSG = 
'The checksum property takes a SHA-256 digest. An MD5 or SHA-1 digest can never match, so the run fails with a checksum mismatch.'
RESOURCES =

the file downloading resources that validate a SHA-256 checksum

%i(remote_file windows_package msu_package dmg_package).freeze
WRONG_ALGORITHM_LENGTHS =

hex digest lengths of the algorithms people reach for by mistake, with the article that reads correctly in front of each name

{ 32 => 'an MD5', 40 => 'a SHA-1' }.freeze

Instance Method Summary collapse

Methods included from RuboCop::Chef::CookbookHelpers

#each_action_symbol, #match_property_in_resource?, #match_resource_type?, #method_arg_ast_to_string, #resource_block_name_if_string

Methods inherited from Base

#target_chef_version

Instance Method Details

#on_block(node) ⇒ Object 



55
56
57
58
59
60
61
62
63
64
65
 
# File 'lib/rubocop/cop/chef/correctness/invalid_checksum.rb', line 55

def on_block(node)
  match_property_in_resource?(RESOURCES, 'checksum', node) do |checksum|
    value = checksum.arguments.first
    next unless value&.str_type?

    algorithm = WRONG_ALGORITHM_LENGTHS[value.value.length]
    next unless algorithm && hex?(value.value)

    add_offense(checksum, message: "#{MSG} This looks like #{algorithm} digest.", severity: :refactor)
  end
end