Fix release hash validation on older Python

2026-08-28 10:44:12 +02:00
parent 9bf9c94dd6
commit 74b2c400c6
4 changed files with 20 additions and 3 deletions
@@ -38,6 +38,14 @@ def find_latest_signed_xpi() -> tuple[str, Path]:
    return max(candidates, key=lambda candidate: version_key(candidate[0]))


+def sha256_digest(xpi_path: Path) -> str:
+    digest = hashlib.sha256()
+    with xpi_path.open('rb') as xpi_file:
+        for block in iter(lambda: xpi_file.read(1024 * 1024), b''):
+            digest.update(block)
+    return digest.hexdigest()
+
+
 def validate_self_update(source_manifest: dict, extension_version: str, xpi_path: Path) -> None:
    gecko_settings = source_manifest.get('browser_specific_settings', {}).get('gecko', {})
    addon_id = gecko_settings.get('id')
@@ -64,8 +72,7 @@ def validate_self_update(source_manifest: dict, extension_version: str, xpi_path
            f'the expected raw signed XPI URL {expected_link!r}'
        )

-    with xpi_path.open('rb') as xpi_file:
-        expected_hash = f'sha256:{hashlib.file_digest(xpi_file, "sha256").hexdigest()}'
+    expected_hash = f'sha256:{sha256_digest(xpi_path)}'
    if entry.get('update_hash') != expected_hash:
        fail(
            f'{UPDATES_PATH.relative_to(ROOT)} update_hash {entry.get("update_hash")!r} does not match '