add check_shasum

README.md

@@ -1,16 +1,23 @@
+# asdf-golang
+
 [![Build Status](https://travis-ci.org/kennyp/asdf-golang.svg?branch=master)](https://travis-ci.org/kennyp/asdf-golang)
 
-# asdf-golang
 golang plugin for [asdf version manager](https://github.com/asdf-vm/asdf)
 
-
 ## Requirements
-**Ubuntu 16.04+** `curl`   
 
+### MacOS
+
+* [GNU Core Utils](http://www.gnu.org/software/coreutils/coreutils.html) - `brew install coreutils`
+
+### Linux (Debian)
+
+* [GNU Core Utils](http://www.gnu.org/software/coreutils/coreutils.html) - `apt install coreutils`
+* [curl](https://curl.haxx.se) - `apt install curl`
 
 ## Install
 
-```
+```bash
 asdf plugin-add golang https://github.com/kennyp/asdf-golang.git
 ```
 
@@ -22,13 +29,12 @@ Check the [asdf](https://github.com/asdf-vm/asdf) readme for instructions on how
 
 After using `go get` to install a package you need to run `asdf reshim golang` to get any new shims.
 
-
 ### Default `go get` packages
 
 asdf-golang can automatically install a default set of packages with `go get -u $PACKAGE` right after installing a new Go version.
 To enable this feature, provide a \$HOME/.default-golang-pkgs file that lists one package per line, for example:
 
-```
+```bash
 // allows comments
 github.com/Dreamacro/clash
 github.com/jesseduffield/lazygit
@@ -44,4 +50,5 @@ Feel free to create an issue or pull request if you find a bug.
 * Assumes x86_64, i386, i686, armv6l, armv7l, arm64 and ppc64le
 
 ## License
+
 MIT License

bin/install

@@ -46,6 +46,24 @@ my_mktemp () {
     echo -n $tempdir
 }
 
+check_shasum() {
+    local archive_file_name=$1
+    local authentic_checksum_file=$2
+    local authentic_checksum=$(cat $authentic_checksum_file)
+
+    if $(command -v sha256sum >/dev/null 2>&1); then
+        sha256sum \
+            -c <<<"$authentic_checksum $archive_file_name"
+    elif $(command -v shasum >/dev/null 2>&1); then
+        shasum \
+        -a 256 \
+        -c <<<"$authentic_checksum $archive_file_name"
+    else
+        echo "sha256sum or shasum is not available for use" >&2
+        return 1
+    fi
+}
+
 install_golang () {
     local install_type=$1
     local version=$2
@@ -55,6 +73,14 @@ install_golang () {
     local tempdir=$(my_mktemp $platform)
 
     curl "https://dl.google.com/go/go${version}.${platform}-${arch}.tar.gz" -o "${tempdir}/archive.tar.gz"
+    curl "https://dl.google.com/go/go${version}.${platform}-${arch}.tar.gz.sha256" -o "${tempdir}/archive.tar.gz.sha256"
+
+    echo 'start check sha256sum'
+    if ! check_shasum "${tempdir}/archive.tar.gz" "${tempdir}/archive.tar.gz.sha256"; then
+        echo "Authenticity of package archive can not be assured. Exiting." >&2
+        rm -rf "${tempdir}"
+        exit 1
+    fi
 
     tar -C "$install_path" -xzf "${tempdir}/archive.tar.gz"