Add hash verification for Linux and Windows

Author: benmcmorran

.github/workflows/build.yml

@@ -24,10 +24,24 @@ jobs:
         os: [ ubuntu-latest, macos-latest, windows-latest ]
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      # Node 14 matches the version of Node used by VS Code when this was
+      # written, but it should be updated when VS Code updates its Node version.
+      # Node needs to be installed before OS-specific setup so that we can run
+      # the hash verification script.
+      - name: Use Node 14.x
+        uses: actions/setup-node@v2
+        with:
+          node-version: 14.x
+
       - name: Windows setup
         if: ${{ matrix.os == 'windows-latest' }}
         run: |
           curl -LO https://downloads.arduino.cc/arduino-1.8.19-windows.zip
+          node build/checkHash.js arduino-1.8.19-windows.zip `
+          c704a821089eab2588f1deae775916219b1517febd1dd574ff29958dca873945
           7z x arduino-1.8.19-windows.zip -o"$Env:TEMP\arduino-ide"
           echo "$Env:TEMP\arduino-ide\arduino-1.8.19" | Out-File -FilePath $env:GITHUB_PATH -Append
       - name: Linux setup
@@ -36,6 +50,8 @@ jobs:
           export CXX="g++-4.9" CC="gcc-4.9" DISPLAY=:99.0
           sleep 3
           wget https://downloads.arduino.cc/arduino-1.8.19-linux64.tar.xz -P /home/$USER
+          node build/checkHash.js /home/$USER/arduino-1.8.19-linux64.tar.xz \
+          eb68bddc1d1c0120be2fca1350a03ee34531cf37f51847b21210b6e70545bc9b
           tar -xvf /home/$USER/arduino-1.8.19-linux64.tar.xz -C /home/$USER/
           sudo ln -s /home/$USER/arduino-1.8.19/arduino /usr/bin/arduino
           sudo apt-get update
@@ -46,15 +62,6 @@ jobs:
           /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"
           brew install arduino --cask
 
-      - name: Checkout
-        uses: actions/checkout@v2
-
-      # Node 14 matches the version of Node used by VS Code when this was
-      # written, but it should be updated when VS Code updates its Node version.
-      - name: Use Node 14.x
-        uses: actions/setup-node@v2
-        with:
-          node-version: 14.x
       # Windows agents already have gulp installed.
       - name: Install gulp
         if: ${{ matrix.os != 'windows-latest' }}

azure-pipelines.yml

@@ -61,10 +61,8 @@ steps:
   - script: curl -LO https://downloads.arduino.cc/arduino-1.8.19-windows.zip
     displayName: Download Arduino IDE
   - script: >-
-      node --eval "process.exit(require('crypto').createHash('sha256').update(
-      require('fs').readFileSync('arduino-1.8.19-windows.zip')).digest('hex')
-      == 'c704a821089eab2588f1deae775916219b1517febd1dd574ff29958dca873945'
-      ? 0 : 1)"
+      node build/checkHash.js arduino-1.8.19-windows.zip
+      c704a821089eab2588f1deae775916219b1517febd1dd574ff29958dca873945
     displayName: Verify Arduino IDE
   - task: ExtractFiles@1
     displayName: Extract Arduino IDE

build/checkHash.js

@@ -0,0 +1,17 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+// Usage
+//   $ node checkHash.js myfile.zip c704...3945
+// Returns with an exit code of zero if and only if the SHA-256 hash of the
+// given file matches the expected hash.
+
+const path = process.argv[2];
+const expected = process.argv[3];
+const data = require('fs').readFileSync(path);
+const hash = require('crypto').createHash('sha256').update(data).digest('hex');
+if (hash !== expected) {
+    console.error(
+        `Expected SHA-256 of "${path}" to be ${expected} but found ${hash}.`);
+    process.exit(1);
+}