Check if a signed URL is specified and use it download tools

Author: MatteoPologruto

tools/download.go

@@ -30,6 +30,7 @@ import (
 	"path/filepath"
 	"runtime"
 
+	"github.com/arduino/arduino-create-agent/utilities"
 	"github.com/arduino/arduino-create-agent/v2/pkgs"
 	"github.com/arduino/go-paths-helper"
 	"github.com/blang/semver"
@@ -98,17 +99,33 @@ func (t *Tools) Download(pack, name, version, behaviour string) error {
 			return t.writeMap()
 		}
 	}
+	return t.download(pack, correctTool.Name, correctTool.Version, correctSystem.URL, correctSystem.Checksum)
+}
+
+// DowloadUsingURL will download the tool from the specified URL if it is signed and can be verified.
+// If no URL is specified, it will follow the standard download procedure.
+func (t *Tools) DownloadFromURL(pack, name, version, behaviour, URL, signature, checksum string) error {
+	if URL != "" && signature != "" && checksum != "" {
+		err := utilities.VerifyInput(URL, signature)
+		if err != nil {
+			return err
+		}
+		return t.download(pack, name, version, URL, checksum)
+	}
+	return t.Download(pack, name, version, behaviour)
+}
 
+func (t *Tools) download(pack, name, version, url, checksum256 string) error {
 	// Download the tool
-	t.logger("Downloading tool " + name + " from " + correctSystem.URL)
-	resp, err := http.Get(correctSystem.URL)
+	t.logger("Downloading tool " + name + " from " + url)
+	resp, err := http.Get(url)
 	if err != nil {
 		return err
 	}
 	defer resp.Body.Close()
 
 	// Read the body
-	body, err = io.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return err
 	}
@@ -117,7 +134,7 @@ func (t *Tools) Download(pack, name, version, behaviour string) error {
 	checksum := sha256.Sum256(body)
 	checkSumString := "SHA-256:" + hex.EncodeToString(checksum[:sha256.Size])
 
-	if checkSumString != correctSystem.Checksum {
+	if checkSumString != checksum256 {
 		return errors.New("checksum doesn't match")
 	}
 
@@ -140,7 +157,7 @@ func (t *Tools) Download(pack, name, version, behaviour string) error {
 		return fmt.Errorf("extracting archive: %s", err)
 	}
 
-	location := t.directory.Join(pack, correctTool.Name, correctTool.Version)
+	location := t.directory.Join(pack, name, version)
 	err = location.RemoveAll()
 	if err != nil {
 		return err
@@ -172,7 +189,7 @@ func (t *Tools) Download(pack, name, version, behaviour string) error {
 	t.logger("Updating map with location " + location.String())
 
 	t.setMapValue(name, location.String())
-	t.setMapValue(name+"-"+correctTool.Version, location.String())
+	t.setMapValue(name+"-"+version, location.String())
 	return t.writeMap()
 }