Flasher: use sha256 algorithm to check the integrity of the Debian image (#706)

Author: MatteoPologruto

arduino-flasher-cli/updater/download_image.go

@@ -3,7 +3,7 @@ package updater
 import (
 	"bytes"
 	"context"
-	"crypto/md5"
+	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
 	"io"
@@ -19,7 +19,7 @@ type Manifest struct {
 	Latest struct {
 		Version string `json:"version"`
 		Url     string `json:"url"`
-		Md5sum  string `json:"md5sum"`
+		Sha256  string `json:"sha256"`
 	} `json:"latest"`
 }
 
@@ -122,16 +122,16 @@ func DownloadImage(client *Client, targetVersion string, upgradeConfirmCb Downlo
 
 	// Download and keep track of the progress
 	src := &PassThru{Reader: download, length: size, progressCB: func(f float64) { feedback.Printf("Download progress: %.2f %%", f) }}
-	md5 := md5.New()
-	if _, err := io.Copy(io.MultiWriter(md5, tmpZipFile), src); err != nil {
+	checksum := sha256.New()
+	if _, err := io.Copy(io.MultiWriter(checksum, tmpZipFile), src); err != nil {
 		return nil, "", err
 	}
 
 	// Check the hash
-	if md5Byte, err := hex.DecodeString(manifest.Latest.Md5sum); err != nil {
-		return nil, "", fmt.Errorf("could not convert md5 from hex to bytes: %w", err)
-	} else if s := md5.Sum(nil); !bytes.Equal(s, md5Byte) {
-		return nil, "", fmt.Errorf("bad hash: %x (expected %x)", s, md5Byte)
+	if sha256Byte, err := hex.DecodeString(manifest.Latest.Sha256); err != nil {
+		return nil, "", fmt.Errorf("could not convert sha256 from hex to bytes: %w", err)
+	} else if s := checksum.Sum(nil); !bytes.Equal(s, sha256Byte) {
+		return nil, "", fmt.Errorf("bad hash: %x (expected %x)", s, sha256Byte)
 	}
 
 	slog.Info("Download of Debian image completed", "path", temp)

arduino-flasher-cli/updater/http_client.go

@@ -1,7 +1,7 @@
 package updater
 
 import (
-	"crypto/md5"
+	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -83,10 +83,10 @@ func (c *Client) GetInfoManifest() (Manifest, error) {
 	if err := json.NewDecoder(resp.Body).Decode(&res); err != nil {
 		return Manifest{}, fmt.Errorf("invalid manifest JSON: %w", err)
 	}
-	if md5Byte, err := hex.DecodeString(res.Latest.Md5sum); err != nil {
-		return Manifest{}, fmt.Errorf("could not convert md5 from hex to bytes: %w", err)
-	} else if len(md5Byte) != md5.Size {
-		return Manifest{}, fmt.Errorf("bad md5sum in manifest: got %d bytes", len(md5Byte))
+	if sha256Byte, err := hex.DecodeString(res.Latest.Sha256); err != nil {
+		return Manifest{}, fmt.Errorf("could not convert sha256 from hex to bytes: %w", err)
+	} else if len(sha256Byte) != sha256.Size {
+		return Manifest{}, fmt.Errorf("bad sha256sum in manifest: got %d bytes", len(sha256Byte))
 	}
 	return res, nil
 }