tasks 1-3

internal/erf/erf.go

@@ -2,14 +2,19 @@ package erf
 
 import (
 	"bytes"
+	"crypto/sha256"
 	"encoding/binary"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"os"
+	"regexp"
 	"sort"
 	"strings"
 )
 
+var expectedSHA256Pattern = regexp.MustCompile(`^[0-9a-f]{64}$`)
+
 const (
 	headerSize = 160
 	versionV10 = "V1.0"
@@ -30,6 +35,9 @@ type Resource struct {
 	Data       []byte
 	SourcePath string
 	Size       int64
+	// ExpectedSHA256, when set, is the lowercase hex SHA-256 the streamed
+	// SourcePath payload must hash to. A mismatch fails the write.
+	ExpectedSHA256 string
 }
 
 type header struct {
@@ -407,18 +415,29 @@ func writeResourceData(w io.Writer, resource Resource) error {
 		return err
 	}
 
+	if resource.ExpectedSHA256 != "" && !expectedSHA256Pattern.MatchString(resource.ExpectedSHA256) {
+		return fmt.Errorf("resource %q has invalid expected sha256", resource.SourcePath)
+	}
+
 	file, err := os.Open(resource.SourcePath)
 	if err != nil {
 		return fmt.Errorf("open resource %q: %w", resource.SourcePath, err)
 	}
 	defer file.Close()
 
-	written, err := io.Copy(w, file)
+	hash := sha256.New()
+	written, err := io.Copy(io.MultiWriter(w, hash), file)
 	if err != nil {
 		return fmt.Errorf("copy resource %q: %w", resource.SourcePath, err)
 	}
 	if resource.Size > 0 && written != resource.Size {
 		return fmt.Errorf("copy resource %q: expected %d bytes, wrote %d", resource.SourcePath, resource.Size, written)
 	}
+	if resource.ExpectedSHA256 != "" {
+		got := hex.EncodeToString(hash.Sum(nil))
+		if got != resource.ExpectedSHA256 {
+			return fmt.Errorf("resource %q sha256 mismatch: expected %s, got %s", resource.SourcePath, resource.ExpectedSHA256, got)
+		}
+	}
 	return nil
 }