security: verify SHA256 of juliaup's own tarball before extraction

.github/workflows/release.yml

@@ -560,6 +560,10 @@ jobs:
         tar -czvf ../../public/bin/juliaup-${{ env.VERSION }}-x86_64-unknown-freebsd.tar.gz .
 
         cd ../..
+    - name: Generate SHA256SUMS
+      run: |
+        cd public/bin
+        sha256sum juliaup-${{ env.VERSION }}-*.tar.gz > juliaup-${{ env.VERSION }}-SHA256SUMS
     - name: Rename and move juliainstaller
       run: |
         mv target/installer/x86_64-apple-darwin/juliainstaller public/bin/juliainstaller-${{ env.VERSION }}-x86_64-apple-darwin

.gitignore

@@ -357,3 +357,4 @@ MigrationBackup/
 .ionide/
 
 !/src/bin
+.DS_Store

Cargo.toml

@@ -63,6 +63,8 @@ numeric-sort = "0.1"
 regex = "1"
 toml = "1.0"
 retry = "2"
+sha2 = "0.10"
+hex = "0.4"
 
 [target.'cfg(windows)'.dependencies]
 windows = { version = "0.62", features = ["Win32_Foundation", "Win32_UI_Shell", "Win32_Security", "Win32_System_JobObjects", "Win32_System_Console", "Win32_System_Threading", "Services_Store", "Foundation", "Foundation_Collections", "Web_Http", "Web_Http_Headers", "Storage_Streams", "Management_Deployment"] }

src/bin/juliainstaller.rs

@@ -229,7 +229,10 @@ pub fn main() -> Result<()> {
         config_file::JuliaupSelfConfig,
         get_juliaup_target, get_own_version,
         global_paths::get_paths,
-        operations::{download_extract_sans_parent, find_shell_scripts_to_be_modified},
+        operations::{
+            download_extract_sans_parent_verified, download_sha256sums_entry,
+            find_shell_scripts_to_be_modified,
+        },
         utils::get_juliaserver_base_url,
     };
     use std::io::Seek;
@@ -450,7 +453,9 @@ pub fn main() -> Result<()> {
     let version = get_own_version().unwrap();
     // let version = semver::Version::parse("1.5.29").unwrap();
 
-    let download_url_path = format!("juliaup/bin/juliaup-{}-{}.tar.gz", version, juliaup_target);
+    let tarball_filename = format!("juliaup-{}-{}.tar.gz", version, juliaup_target);
+    let download_url_path = format!("juliaup/bin/{}", tarball_filename);
+    let sha256sums_url_path = format!("juliaup/bin/juliaup-{}-SHA256SUMS", version);
 
     let new_juliaup_url = juliaupserver_base
         .join(&download_url_path)
@@ -461,7 +466,23 @@ pub fn main() -> Result<()> {
             )
         })?;
 
-    download_extract_sans_parent(new_juliaup_url.as_ref(), &juliaupselfbin, 0)?;
+    let sha256sums_url = juliaupserver_base
+        .join(&sha256sums_url_path)
+        .with_context(|| {
+            format!(
+                "Failed to construct SHA256SUMS url from '{}' and '{}'.",
+                juliaupserver_base, sha256sums_url_path
+            )
+        })?;
+    let expected_sha256 = download_sha256sums_entry(sha256sums_url.as_ref(), &tarball_filename)
+        .with_context(|| "Failed to obtain SHA256 checksum for the juliaup installer.")?;
+
+    download_extract_sans_parent_verified(
+        new_juliaup_url.as_ref(),
+        &juliaupselfbin,
+        0,
+        &expected_sha256,
+    )?;
 
     {
         let new_selfconfig_data = JuliaupSelfConfig {

src/command_selfupdate.rs

@@ -5,7 +5,9 @@ use anyhow::{Context, Result};
 #[cfg(feature = "selfupdate")]
 pub fn run_command_selfupdate(paths: &GlobalPaths) -> Result<()> {
     use crate::config_file::{load_mut_config_db, save_config_db};
-    use crate::operations::{download_extract_sans_parent, download_juliaup_version};
+    use crate::operations::{
+        download_extract_sans_parent_verified, download_juliaup_version, download_sha256sums_entry,
+    };
     use crate::utils::get_juliaserver_base_url;
     use crate::{get_juliaup_target, get_own_version};
     use anyhow::{anyhow, bail};
@@ -83,7 +85,25 @@ pub fn run_command_selfupdate(paths: &GlobalPaths) -> Result<()> {
             version, juliaup_channel
         );
 
-        download_extract_sans_parent(new_juliaup_url.as_ref(), my_own_folder, 0)?;
+        let tarball_filename = format!("juliaup-{}-{}.tar.gz", version, juliaup_target);
+        let sha256sums_url_path = format!("juliaup/bin/juliaup-{}-SHA256SUMS", version);
+        let sha256sums_url = juliaupserver_base
+            .join(&sha256sums_url_path)
+            .with_context(|| {
+                format!(
+                    "Failed to construct SHA256SUMS url from '{}' and '{}'.",
+                    juliaupserver_base, sha256sums_url_path
+                )
+            })?;
+        let expected_sha256 = download_sha256sums_entry(sha256sums_url.as_ref(), &tarball_filename)
+            .with_context(|| "Failed to obtain SHA256 checksum for the juliaup update.")?;
+
+        download_extract_sans_parent_verified(
+            new_juliaup_url.as_ref(),
+            my_own_folder,
+            0,
+            &expected_sha256,
+        )?;
         eprintln!("Updated Juliaup to version {}.", version);
     }