Add checksum validation on artifact upload

packages/artifact/__tests__/crc64.test.ts

@@ -0,0 +1,57 @@
+import CRC64, {CRC64DigestEncoding} from '../src/internal/crc64'
+
+const fixtures = {
+  data:
+    '🚀 👉😎👉 Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.\nUt enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.\nDuis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur.\nExcepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.\n',
+  expected: {
+    hex: '846CE4ADAD6223ED',
+    base64: '7SNira3kbIQ=',
+    buffer: Buffer.from([0xed, 0x23, 0x62, 0xad, 0xad, 0xe4, 0x6c, 0x84])
+  }
+}
+
+function assertEncodings(crc: CRC64): void {
+  const encodings = Object.keys(fixtures.expected) as CRC64DigestEncoding[]
+  for (const encoding of encodings) {
+    expect(crc.digest(encoding)).toEqual(fixtures.expected[encoding])
+  }
+}
+
+describe('@actions/artifact/src/internal/crc64', () => {
+  it('CRC64 from string', async () => {
+    const crc = new CRC64()
+    crc.update(fixtures.data)
+
+    assertEncodings(crc)
+  })
+
+  it('CRC64 from buffer', async () => {
+    const crc = new CRC64()
+    const buf = Buffer.from(fixtures.data)
+    crc.update(buf)
+
+    assertEncodings(crc)
+  })
+
+  it('CRC64 from split data', async () => {
+    const crc = new CRC64()
+    const splits = fixtures.data.split('\n').slice(0, -1)
+    for (const split of splits) {
+      crc.update(`${split}\n`)
+    }
+
+    assertEncodings(crc)
+  })
+
+  it('flips 64 bits', async () => {
+    const tests = [
+      [BigInt(0), BigInt('0xffffffffffffffff')],
+      [BigInt('0xffffffffffffffff'), BigInt(0)],
+      [BigInt('0xdeadbeef'), BigInt('0xffffffff21524110')]
+    ]
+
+    for (const [input, expected] of tests) {
+      expect(CRC64.flip64Bits(input)).toEqual(expected)
+    }
+  })
+})

packages/artifact/__tests__/util.test.ts

@@ -10,6 +10,7 @@ import {
   getInitialRetryIntervalInMilliseconds,
   getRetryMultiplier
 } from '../src/internal/config-variables'
+import {Readable} from 'stream'
 
 jest.mock('../src/internal/config-variables')
 
@@ -74,15 +75,20 @@ describe('Utils', () => {
     const size = 24
     const uncompressedLength = 100
     const range = 'bytes 0-199/200'
+    const digest = {
+      crc64: 'bSzITYnW/P8=',
+      md5: 'Xiv1fT9AxLbfadrxk2y3ZvgyN0tPwCWafL/wbi9w8mk='
+    }
     const headers = utils.getUploadHeaders(
       contentType,
       true,
       true,
       uncompressedLength,
       size,
-      range
+      range,
+      digest
     )
-    expect(Object.keys(headers).length).toEqual(8)
+    expect(Object.keys(headers).length).toEqual(10)
     expect(headers['Accept']).toEqual(
       `application/json;api-version=${utils.getApiVersion()}`
     )
@@ -93,6 +99,8 @@ describe('Utils', () => {
     expect(headers['x-tfs-filelength']).toEqual(uncompressedLength)
     expect(headers['Content-Length']).toEqual(size)
     expect(headers['Content-Range']).toEqual(range)
+    expect(headers['x-actions-results-crc64']).toEqual(digest.crc64)
+    expect(headers['x-actions-results-md5']).toEqual(digest.md5)
   })
 
   it('Test constructing upload headers with only required parameter', () => {
@@ -219,4 +227,13 @@ describe('Utils', () => {
     const size2 = (await fs.promises.stat(emptyFile2)).size
     expect(size2).toEqual(0)
   })
+
+  it('Creates a digest from a readable stream', async () => {
+    const data = 'lorem ipsum'
+    const stream = Readable.from(data)
+    const digest = await utils.digestForStream(stream)
+
+    expect(digest.crc64).toBe('bSzITYnW/P8=')
+    expect(digest.md5).toBe('gKdR/eV3AoZAxBkADjPrpg==')
+  })
 })