Switch to SHA256 for third-party bundles downloading

Closes #2107

third-party/CMakeLists.txt

@@ -50,25 +50,25 @@ endif()
 include(ExternalProject)
 
 set(LIBUV_URL https://github.com/libuv/libuv/archive/v1.2.0.tar.gz)
-set(LIBUV_SHA1 38d1ba349fcfc1b221140523ba3d7cf3ea38c20b)
+set(LIBUV_SHA256 bebf424bb239867bbf609abad09a256cae7808c9d5cb346b779acd4b97a56693)
 
 set(MSGPACK_URL https://github.com/msgpack/msgpack-c/archive/f6d0cd9a4ba46f4341014a199e3d352fad76b215.tar.gz)
-set(MSGPACK_SHA1 112ef2e8c58b26ba958554e17df81b1dcd610e9a)
+set(MSGPACK_SHA256 988bb2bf86bb0f69816cbcbe2218285b94dbaa27e839f8b1ffdb0b934a7d726a)
 
 set(LUAJIT_URL http://luajit.org/download/LuaJIT-2.0.3.tar.gz)
-set(LUAJIT_SHA1 2db39e7d1264918c2266b0436c313fbd12da4ceb)
+set(LUAJIT_SHA256 55be6cb2d101ed38acca32c5b1f99ae345904b365b642203194c585d27bebd79)
 
 set(LUAROCKS_URL https://github.com/keplerproject/luarocks/archive/0587afbb5fe8ceb2f2eea16f486bd6183bf02f29.tar.gz)
-set(LUAROCKS_SHA1 61a894fd5d61987bf7e7f9c3e0c5de16ba4b68c4)
+set(LUAROCKS_SHA256 c8ad50938fed66beba74a73621d14121d4a40b796e01c45238de4cdcb47d5e0b)
 
 set(LIBUNIBILIUM_URL https://github.com/mauke/unibilium/archive/bb979ff6f66a18663e15d086dec6276561b86ee0.tar.gz)
-set(LIBUNIBILIUM_SHA1 32c07797f298e5bc722ce14b6b9a2cae68e3c018)
+set(LIBUNIBILIUM_SHA256 bec06ea90128b46f28b91b8b52b861dede5f4ede0a92f05178b3c7bcec237dd1)
 
 set(LIBTERMKEY_URL https://github.com/neovim/libtermkey/archive/8c0cb7108cc63218ea19aa898968eede19e19603.tar.gz)
-set(LIBTERMKEY_SHA1 54e8b6914dab10d4467d2a563f80053a99849fcb)
+set(LIBTERMKEY_SHA256 21846369081e6c9a0b615f4b3889c4cb809321c5ccc6e6c1640eb138f1590072)
 
 set(LIBVTERM_URL https://github.com/neovim/libvterm/archive/dd92e5ba5b0907571df938ac7601b1641f05ed16.tar.gz)
-set(LIBVTERM_SHA1 9e4c4cdfc4925f1882b704e84c7360e70aeb3d31)
+set(LIBVTERM_SHA256 850780dfef9e576c06b0e31ea1356da17da2bb4fd9e065a23ac50c88db2b0630)
 
 
 if(USE_BUNDLED_LIBUNIBILIUM)
@@ -80,7 +80,7 @@ if(USE_BUNDLED_LIBUNIBILIUM)
       -DPREFIX=${DEPS_BUILD_DIR}
       -DDOWNLOAD_DIR=${DEPS_DOWNLOAD_DIR}/libunibilium
       -DURL=${LIBUNIBILIUM_URL}
-      -DEXPECTED_SHA1=${LIBUNIBILIUM_SHA1}
+      -DEXPECTED_SHA256=${LIBUNIBILIUM_SHA256}
       -DTARGET=libunibilium
       -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/DownloadAndExtractFile.cmake
     CONFIGURE_COMMAND ""
@@ -101,7 +101,7 @@ if(USE_BUNDLED_LIBTERMKEY)
       -DPREFIX=${DEPS_BUILD_DIR}
       -DDOWNLOAD_DIR=${DEPS_DOWNLOAD_DIR}/libtermkey
       -DURL=${LIBTERMKEY_URL}
-      -DEXPECTED_SHA1=${LIBTERMKEY_SHA1}
+      -DEXPECTED_SHA256=${LIBTERMKEY_SHA256}
       -DTARGET=libtermkey
       -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/DownloadAndExtractFile.cmake
     CONFIGURE_COMMAND ""
@@ -125,7 +125,7 @@ if(USE_BUNDLED_LIBVTERM)
       -DPREFIX=${DEPS_BUILD_DIR}
       -DDOWNLOAD_DIR=${DEPS_DOWNLOAD_DIR}/libvterm
       -DURL=${LIBVTERM_URL}
-      -DEXPECTED_SHA1=${LIBVTERM_SHA1}
+      -DEXPECTED_SHA256=${LIBVTERM_SHA256}
       -DTARGET=libvterm
       -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/DownloadAndExtractFile.cmake
     CONFIGURE_COMMAND ""
@@ -148,7 +148,7 @@ if(USE_BUNDLED_LIBUV)
       -DPREFIX=${DEPS_BUILD_DIR}
       -DDOWNLOAD_DIR=${DEPS_DOWNLOAD_DIR}/libuv
       -DURL=${LIBUV_URL}
-      -DEXPECTED_SHA1=${LIBUV_SHA1}
+      -DEXPECTED_SHA256=${LIBUV_SHA256}
       -DTARGET=libuv
       -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/DownloadAndExtractFile.cmake
     CONFIGURE_COMMAND sh ${DEPS_BUILD_DIR}/src/libuv/autogen.sh &&
@@ -168,7 +168,7 @@ if(USE_BUNDLED_MSGPACK)
       -DPREFIX=${DEPS_BUILD_DIR}
       -DDOWNLOAD_DIR=${DEPS_DOWNLOAD_DIR}/msgpack
       -DURL=${MSGPACK_URL}
-      -DEXPECTED_SHA1=${MSGPACK_SHA1}
+      -DEXPECTED_SHA256=${MSGPACK_SHA256}
       -DTARGET=msgpack
       -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/DownloadAndExtractFile.cmake
     CONFIGURE_COMMAND cmake ${DEPS_BUILD_DIR}/src/msgpack
@@ -193,7 +193,7 @@ if(USE_BUNDLED_LUAJIT)
       -DPREFIX=${DEPS_BUILD_DIR}
       -DDOWNLOAD_DIR=${DEPS_DOWNLOAD_DIR}/luajit
       -DURL=${LUAJIT_URL}
-      -DEXPECTED_SHA1=${LUAJIT_SHA1}
+      -DEXPECTED_SHA256=${LUAJIT_SHA256}
       -DTARGET=luajit
       -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/DownloadAndExtractFile.cmake
     CONFIGURE_COMMAND ""
@@ -225,7 +225,7 @@ if(USE_BUNDLED_LUAROCKS)
       -DPREFIX=${DEPS_BUILD_DIR}
       -DDOWNLOAD_DIR=${DEPS_DOWNLOAD_DIR}/luarocks
       -DURL=${LUAROCKS_URL}
-      -DEXPECTED_SHA1=${LUAROCKS_SHA1}
+      -DEXPECTED_SHA256=${LUAROCKS_SHA256}
       -DTARGET=luarocks
       -P ${CMAKE_CURRENT_SOURCE_DIR}/cmake/DownloadAndExtractFile.cmake
     BUILD_IN_SOURCE 1

third-party/cmake/DownloadAndExtractFile.cmake

@@ -10,8 +10,8 @@ if(NOT DEFINED DOWNLOAD_DIR)
   message(FATAL_ERROR "DOWNLOAD_DIR must be defined.")
 endif()
 
-if(NOT DEFINED EXPECTED_SHA1)
+if(NOT DEFINED EXPECTED_SHA256)
-  message(FATAL_ERROR "EXPECTED_SHA1 must be defined.")
+  message(FATAL_ERROR "EXPECTED_SHA256 must be defined.")
 endif()
 
 if(NOT DEFINED TARGET)
@@ -75,18 +75,18 @@ if(NOT status_code EQUAL 0)
 ")
 endif()
 
-set(NULL_SHA1 "0000000000000000000000000000000000000000")
+set(NULL_SHA256 "0000000000000000000000000000000000000000000000000000000000000000")
 
-# Allow users to use "SKIP" or "skip" as the sha1 to skip checking the hash.
+# Allow users to use "SKIP" or "skip" as the sha256 to skip checking the hash.
 # You can still use the all zeros hash too.
-if((EXPECTED_SHA1 STREQUAL "SKIP") OR (EXPECTED_SHA1 STREQUAL "skip"))
+if((EXPECTED_SHA256 STREQUAL "SKIP") OR (EXPECTED_SHA256 STREQUAL "skip"))
-  set(EXPECTED_SHA1 ${NULL_SHA1})
+  set(EXPECTED_SHA256 ${NULL_SHA256})
 endif()
 
-# We could avoid computing the SHA1 entirely if a NULL_SHA1 was given,
+# We could avoid computing the SHA256 entirely if a NULL_SHA256 was given,
 # but we want to warn users of an empty file.
-file(SHA1 ${file} ACTUAL_SHA1)
+file(SHA256 ${file} ACTUAL_SHA256)
-if(ACTUAL_SHA1 STREQUAL "da39a3ee5e6b4b0d3255bfef95601890afd80709")
+if(ACTUAL_SHA256 STREQUAL "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855")
   # File was empty.  It's likely due to lack of SSL support.
   message(FATAL_ERROR
     "Failed to download ${URL}.  The file is empty and likely means CMake "
@@ -94,12 +94,12 @@ if(ACTUAL_SHA1 STREQUAL "da39a3ee5e6b4b0d3255bfef95601890afd80709")
     "proper SSL support.  See "
     "https://github.com/neovim/neovim/wiki/Building-Neovim#build-prerequisites "
     "for more information.")
-elseif((NOT EXPECTED_SHA1 STREQUAL NULL_SHA1) AND
+elseif((NOT EXPECTED_SHA256 STREQUAL NULL_SHA256) AND
-       (NOT EXPECTED_SHA1 STREQUAL ACTUAL_SHA1))
+       (NOT EXPECTED_SHA256 STREQUAL ACTUAL_SHA256))
-  # Wasn't a NULL SHA1 and we didn't match, so we fail.
+  # Wasn't a NULL SHA256 and we didn't match, so we fail.
   message(FATAL_ERROR
-    "Failed to download ${URL}.  Expected a SHA1 of "
+    "Failed to download ${URL}.  Expected a SHA256 of "
-    "${EXPECTED_SHA1} but got ${ACTUAL_SHA1} instead.")
+    "${EXPECTED_SHA256} but got ${ACTUAL_SHA256} instead.")
 endif()
 
 message(STATUS "downloading... done")