Verify hash of freetype tarball

mdboom · mdboom · commit 532a06e03bb5 · 2015-10-24T09:07:31.000-04:00
diff --git a/setupext.py b/setupext.py
@@ -23,7 +23,8 @@
 # of freetype.  It must match the value in
 # lib/matplotlib.__init__.py:validate_test_dependencies
 LOCAL_FREETYPE_VERSION = '2.5.2'
-
+# md5 hash of the freetype tarball
+LOCAL_FREETYPE_HASH = '004320381043d275c4e28bbacf05a1b7'
 
 try:
     from subprocess import check_output
@@ -247,6 +248,21 @@ def make_extension(name, files, *args, **kwargs):
     return ext
 
 
+def get_file_hash(filename):
+    """
+    Get the MD5 hash of a given filename.
+    """
+    import hashlib
+    BLOCKSIZE = 1 << 16
+    hasher = hashlib.md5()
+    with open(filename, 'rb') as fd:
+        buf = fd.read(BLOCKSIZE)
+        while len(buf) > 0:
+            hasher.update(buf)
+            buf = fd.read(BLOCKSIZE)
+    return hasher.hexdigest()
+
+
 class PkgConfig(object):
     """
     This is a class for communicating with pkg-config.
@@ -991,15 +1007,18 @@ def do_custom_build(self):
         tarball = 'freetype-{0}.tar.gz'.format(LOCAL_FREETYPE_VERSION)
         tarball_path = os.path.join('build', tarball)
         if not os.path.isfile(tarball_path):
-            print("Downloading {0}".format(tarball))
+            tarball_url = 'http://download.savannah.gnu.org/releases/freetype/{0}'.format(tarball)
+
+            print("Downloading {0}".format(tarball_url))
             if sys.version_info[0] == 2:
                 from urllib import urlretrieve
             else:
                 from urllib.request import urlretrieve
 
-            urlretrieve(
-                'http://download.savannah.gnu.org/releases/freetype/{0}'.format(tarball),
-                tarball_path)
+            urlretrieve(tarball_url, tarball_path)
+
+            if get_file_hash(tarball_path) != LOCAL_FREETYPE_HASH:
+                raise IOError("{0} does not match expected hash.".format(tarball))
 
         print("Building {0}".format(tarball))
         subprocess.check_call(
