[RubyGemsGemInstaller] Validate checksums from the compact index

2 files changed, 23 insertions, 1 deletions

diff --git a/spec/support/artifice/compact_index.rb b/spec/support/artifice/compact_index.rb
index 233c192a67..f3ff2db4fa 100644
--- a/spec/support/artifice/compact_index.rb
+++ b/spec/support/artifice/compact_index.rb
@@ -78,7 +78,12 @@ class CompactIndexAPI < Endpoint
               reqs = d.requirement.requirements.map {|r| r.join(" ") }.join(", ")
               CompactIndex::Dependency.new(d.name, reqs)
             end
-            CompactIndex::GemVersion.new(spec.version.version, spec.platform.to_s, nil, nil,
+            checksum = begin
+                         Digest::SHA256.file("#{GEM_REPO}/gems/#{spec.original_name}.gem").base64digest
+                       rescue
+                         nil
+                       end
+            CompactIndex::GemVersion.new(spec.version.version, spec.platform.to_s, checksum, nil,
               deps, spec.required_ruby_version, spec.required_rubygems_version)
           end
           CompactIndex::Gem.new(name, gem_versions)
diff --git a/spec/support/artifice/compact_index_wrong_gem_checksum.rb b/spec/support/artifice/compact_index_wrong_gem_checksum.rb
new file mode 100644
index 0000000000..6af64856aa
--- /dev/null
+++ b/spec/support/artifice/compact_index_wrong_gem_checksum.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+require File.expand_path("../compact_index", __FILE__)
+
+Artifice.deactivate
+
+class CompactIndexWrongGemChecksum < CompactIndexAPI
+  get "/info/:name" do
+    etag_response do
+      gem = gems.find {|g| g.name == params[:name] }
+      versions = gem ? gem.versions : []
+      versions.each {|v| v.checksum = "checksum!" }
+      CompactIndex.info(versions)
+    end
+  end
+end
+
+Artifice.activate_with(CompactIndexWrongGemChecksum)