Repository: goreleaser/nfpm
Pull request #295 (2021-02-10 18:41:03)

fix: apk checksums
- looking at official packages, seems like only SHA1 is needed (made a small thing to check that: https://github.com/caarlos0/apkcat)
- added tests
- fixed the missing write to the hasher function

The packages actually had the file contents as a header as well as far as I understand. 

PS: tested it with goreleaser itself as well.

Refs https://github.com/goreleaser/nfpm/commit/3b7e01508a19a2fa6e2ebb1b4685dd4e3cbfd785
refs #291

vercel[bot]: This pull request is being automatically deployed with Vercel ([learn more](https://vercel.link/github-learn-more)).  
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: [https://vercel.com/goreleaser/nfpm/pnvrp3480](https://vercel.com/goreleaser/nfpm/pnvrp3480)  
✅ Preview: [https://nfpm-git-apk.goreleaser.vercel.app](https://nfpm-git-apk.goreleaser.vercel.app)


codecov[bot]: # [Codecov](https://codecov.io/gh/goreleaser/nfpm/pull/295?src=pr&el=h1) Report
> Merging [#295](https://codecov.io/gh/goreleaser/nfpm/pull/295?src=pr&el=desc) (f0ad2fa) into [master](https://codecov.io/gh/goreleaser/nfpm/commit/9839777927ce128c8c4037653a2a177c784a4149?el=desc) (9839777) will **increase** coverage by `0.02%`.
> The diff coverage is `42.85%`.

[![Impacted file tree graph](https://codecov.io/gh/goreleaser/nfpm/pull/295/graphs/tree.svg?width=650&height=150&src=pr&token=9QKGIxn7wg)](https://codecov.io/gh/goreleaser/nfpm/pull/295?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master     #295      +/-   ##
==========================================
+ Coverage   70.10%   70.13%   +0.02%     
==========================================
  Files           9        9              
  Lines        1104     1105       +1     
==========================================
+ Hits          774      775       +1     
  Misses        204      204              
  Partials      126      126              
```


| [Impacted Files](https://codecov.io/gh/goreleaser/nfpm/pull/295?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [apk/apk.go](https://codecov.io/gh/goreleaser/nfpm/pull/295/diff?src=pr&el=tree#diff-YXBrL2Fway5nbw==) | `70.46% <42.85%> (+0.12%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/goreleaser/nfpm/pull/295?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/goreleaser/nfpm/pull/295?src=pr&el=footer). Last update [9839777...f0ad2fa](https://codecov.io/gh/goreleaser/nfpm/pull/295?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/apk/apk.go b/apk/apk.go
index f0ed116..0f24b1c 100644
--- a/apk/apk.go
+++ b/apk/apk.go
@@ -31,10 +31,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"crypto"
-	_ "crypto/md5"
 	_ "crypto/sha1" // nolint:gosec
-	_ "crypto/sha256"
-	_ "crypto/sha512"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -74,13 +71,6 @@ var archToAlpine = map[string]string{
 	// "s390x":  "???",
 }
 
-var supportedChecksumHash = map[crypto.Hash]string{
-	crypto.MD5:    "MD5",
-	crypto.SHA1:   "SHA1",
-	crypto.SHA256: "SHA256",
-	crypto.SHA512: "SHA512",
-}
-
 // Default apk packager.
 // nolint: gochecknoglobals
 var Default = &Apk{}
@@ -388,18 +378,17 @@ func newItemInsideTarGz(out *tar.Writer, content []byte, header *tar.Header) err
 	header.Format = tar.FormatPAX
 	header.PAXRecords = make(map[string]string)
 
-	for hasher, name := range supportedChecksumHash {
-		if !hasher.Available() {
-			continue
-		}
-		hash := hasher.New()
-		header.PAXRecords[fmt.Sprintf("APK-TOOLS.checksum.%s", name)] = fmt.Sprintf("%x", hash.Sum(content))
+	hasher := crypto.SHA1.New()
+	_, err := hasher.Write(content)
+	if err!=nil{
+		return fmt.Errorf("failed to hash content of file %s: %w", header.Name, err)
 	}
+	header.PAXRecords["APK-TOOLS.checksum.SHA1"] = fmt.Sprintf("%x", hasher.Sum(nil))
 	if err := out.WriteHeader(header); err != nil {
-		return fmt.Errorf("cannot write header of %s file to control.tar.gz: %w", header.Name, err)
+		return fmt.Errorf("cannot write header of %s file to apk: %w", header.Name, err)
 	}
 	if _, err := out.Write(content); err != nil {
-		return fmt.Errorf("cannot write %s file to control.tar.gz: %w", header.Name, err)
+		return fmt.Errorf("cannot write %s file to apk: %w", header.Name, err)
 	}
 	return nil
 }
diff --git a/go.sum b/go.sum
index 1de0fda..0e457e3 100644
--- a/go.sum
+++ b/go.sum
@@ -216,8 +216,7 @@ github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGa
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/goreleaser/chglog v0.1.2 h1:tdzAb/ILeMnphzI9zQ7Nkq+T8R9qyXli8GydD8plFRY=
 github.com/goreleaser/chglog v0.1.2/go.mod h1:tTZsFuSZK4epDXfjMkxzcGbrIOXprf0JFp47BjIr3B8=
-github.com/goreleaser/fileglob v0.3.1 h1:OTFDWqUUHjQazk2N5GdUqEbqT/grBnRARaAXsV07q1Y=
-github.com/goreleaser/fileglob v0.3.1/go.mod h1:kNcPrPzjCp+Ox3jmXLU5QEsjhqrtLBm6OnXAif8KRl8=
+github.com/goreleaser/fileglob v0.4.0 h1:bZfPopbWScZi0MrsV+9YcJ0dN8w5OV4OwjDzrHI1Zyw=
 github.com/goreleaser/fileglob v0.4.0/go.mod h1:kNcPrPzjCp+Ox3jmXLU5QEsjhqrtLBm6OnXAif8KRl8=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gostaticanalysis/analysisutil v0.0.0-20190318220348-4088753ea4d3/go.mod h1:eEOZF4jCKGi+aprrirO9e7WKB3beBRtWgqGunKl6pKE=


Test patch:
diff --git a/apk/apk_test.go b/apk/apk_test.go
index c021ab1..c172327 100644
--- a/apk/apk_test.go
+++ b/apk/apk_test.go
@@ -147,13 +147,34 @@ func TestPathsToCreate(t *testing.T) {
 }
 
 func TestDefaultWithArch(t *testing.T) {
+	expectedChecksums := map[string]string{
+		"usr/share/doc/fake/fake.txt": "96c335dc28122b5f09a4cef74b156cd24c23784c",
+		"usr/local/bin/fake":          "f46cece3eeb7d9ed5cb244d902775427be71492d",
+		"etc/fake/fake.conf":          "96c335dc28122b5f09a4cef74b156cd24c23784c",
+	}
 	for _, arch := range []string{"386", "amd64"} {
 		arch := arch
 		t.Run(arch, func(t *testing.T) {
 			info := exampleInfo()
 			info.Arch = arch
-			var err = Default.Package(info, ioutil.Discard)
-			assert.NoError(t, err)
+
+			var f bytes.Buffer
+			require.NoError(t, Default.Package(info, &f))
+
+			gz, err := gzip.NewReader(&f)
+			require.NoError(t, err)
+			defer gz.Close()
+			tr := tar.NewReader(gz)
+
+			for {
+				hdr, err := tr.Next()
+				if errors.Is(err, io.EOF) {
+					break // End of archive
+				}
+				require.NoError(t, err)
+
+				require.Equal(t, expectedChecksums[hdr.Name], hdr.PAXRecords["APK-TOOLS.checksum.SHA1"], hdr.Name)
+			}
 		})
 	}
 }