Tool to download each URL and verify each hash

[jnm2]

At NUnit, we want to be able to guarantee that a release does not go out unless the commit is pushed to GitHub and that each download hashes correctly so that things like line endings don't trip us up.

Is there an existing tool for this which is compatible with GitLink v3? If not, what would it take to build one?

[GeertvanHorrik]

Hmmm, good question. I think you might be interested in GitTools.Core (which GitLink uses) that uses dynamic repositories. There you can basically do a hash check (as a separate tooling).

Another option is to just create a very simple (non-generic) tool that uses LibGit2Sharp to download the checksums before doing anything else.

[toughengineer]

Not sure it is relevant here, but for one you can use srctool from Debugging tools for Windows to get hashes from PDB:

srctool -r -h module.pdb

which gives output like this:

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\srcsrv>srctool -r -h boost_program_options-vc120-mt-x64-1_66.pdb
e:\packages\boost\1.66.0-1\aligntech\stable\source\src\boost\predef\architecture\rs6k.h  Checksum MD5: B6E69FC5AEA201F2F0B29C24AA7E2AFD
e:\packages\boost\1.66.0-1\aligntech\stable\source\src\boost\iterator\reverse_iterator.hpp       Checksum MD5: 8B78865166ADC1D742E47797436D2E80
c:\program files (x86)\microsoft visual studio 12.0\vc\include\xmmintrin.h       Checksum MD5: 4311EA077B883259CF6FDE8A6D55B247
e:\packages\boost\1.66.0-1\aligntech\stable\source\src\boost\mpl\remove_if.hpp   Checksum MD5: 093BFBA7BD6AFC61146E78064288EEC5
e:\packages\boost\1.66.0-1\aligntech\stable\source\src\boost\predef\architecture\sparc.h         Checksum MD5: 5AD298903287010C3BF9A6EB24E4E734
e:\packages\boost\1.66.0-1\aligntech\stable\source\src\boost\iterator\iterator_adaptor.hpp       Checksum MD5: 75D63C1355EE459AF14D83D0E5A8D75E
e:\packages\boost\1.66.0-1\aligntech\stable\source\src\boost\core\checked_delete.hpp     Checksum MD5: BA23A1C4E751A1C0BD5EF95D2A09CD7B
e:\packages\boost\1.66.0-1\aligntech\stable\source\src\boost\bind\mem_fn_template.hpp    Checksum MD5: 0361F51130E131B33AAB0665C59680DF
c:\program files (x86)\microsoft visual studio 12.0\vc\include\mmintrin.h        Checksum MD5: 7BBD822C1DAB43CA7D459F675B0219EC

Then using srctool you can get either urls or commands for indexed files in PDB (see output of srctool without parameters for usage help). So the process could be like this:

1. srctool -r -h module.pdb
2. get sources
3. ???
4. PROFIT!!!

It works for native code, didn't try it for .NET code.