mirror of
https://github.com/fleetdm/fleet
synced 2026-05-18 14:38:53 +00:00
99d03a61de
For #26692. # Checklist for submitter If some of the following don't apply, delete the relevant line. <!-- Note that API documentation changes are now addressed by the product design team. --> Changes file included in FE PR. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] Added/updated automated tests - [x] A detailed QA plan exists on the associated ticket (if it isn't there, work with the product group's QA engineer to add it) - [x] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Make sure fleetd is compatible with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/fleetd-development-and-release-strategy.md)). - [ ] Orbit runs on macOS, Linux and Windows. Check if the orbit feature/bugfix should only apply to one platform (`runtime.GOOS`). - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)).
40 lines
926 B
Go
40 lines
926 B
Go
package file
|
|
|
|
import (
|
|
"archive/tar"
|
|
"compress/gzip"
|
|
"crypto/sha256"
|
|
"fmt"
|
|
"io"
|
|
)
|
|
|
|
// ValidateTarball confirms that a .tar.gz file is valid, then returns empty installer metadata for fallback
|
|
func ValidateTarball(r io.Reader) (*InstallerMetadata, error) {
|
|
h := sha256.New()
|
|
r = io.TeeReader(r, h)
|
|
gz, err := gzip.NewReader(r)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to create gzip reader: %w", err)
|
|
}
|
|
defer gz.Close()
|
|
r = gz
|
|
|
|
// validate tar archive
|
|
tr := tar.NewReader(r)
|
|
for {
|
|
_, err := tr.Next()
|
|
if err == io.EOF {
|
|
break
|
|
} else if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
// ensure the whole file is read to get the correct hash
|
|
if _, err := io.Copy(io.Discard, r); err != nil {
|
|
return nil, fmt.Errorf("failed to read all content: %w", err)
|
|
}
|
|
|
|
// return empty installer metadata; fallback for name/version is handled in the caller
|
|
return &InstallerMetadata{SHASum: h.Sum(nil)}, nil
|
|
}
|