I would like to propose an addition to the notepad-plus-plus package, specifically to the update_package function.
Looking at the Notepad github, I noticed that they were providing the file hashes.
Why not do this additional check?
To achieve this, I propose two fairly simple pieces of code:
Code: Select all
import hashlib
# Obtention du hash du fichier fournit sur le Github
github_url = 'https://github.com/notepad-plus-plus/notepad-plus-plus/releases'
github_page = wgets(github_url)
checksum_regex = re.compile(r'([a-f0-9]{64}) ' + filenamex64)
checksum = checksum_regex.findall(github_page)[0]
# Obtention du hash calculé du fichier téléchargé
sha256_hash = hashlib.sha256()
with open(filenamex64, 'rb') as f:
for byte_block in iter(lambda: f.read(4096),b''):
sha256_hash.update(byte_block)
print(sha256_hash.hexdigest())
if sha256_hash != checksum:
print(f'Integrity check failed. The file may have been corrupted or an error occured while downloading.')
Example using notepadplus:
Code: Select all
from pkg_resources import parse_version
url = 'https://api.github.com/repos/notepad-plus-plus/notepad-plus-plus/releases/latest'
data = json.loads(wgets(url, proxies=proxies))
assets = data['assets']
filenamex64, url64 = [(str(p['name']), str(p['browser_download_url'])) for p in assets if 'Installer.x64.exe' in p['name']][0]
package_version = control.get_software_version()
latest_version = filenamex64.split('npp.',)[1].split('.Installer.x64.exe')[0]
for fileexe in glob.glob('npp.*.Installer.x64.exe'):
if parse_version(package_version) < parse_version(latest_version)
print('Delete ' +
remove_file(fileexe)
[...]
Sincerely,
Étienne
