fix(s3-upload): generate checksum on upload to ensure data integrity

anagrambuild · Oct 24, 2024 · b771fe2 · b771fe2
1 parent b6cc5a9
commit b771fe2
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/.github/workflows/s3-prover-sync.yml b/.github/workflows/s3-prover-sync.yml
@@ -31,7 +31,9 @@ jobs:
         run: |
           docker build --progress=plain -f .github/docker/Dockerfile.prover -o risc0-groth16-prover . --build-arg PROVER_TAG=${PROVER_TAG}
           for file in risc0-groth16-prover/${PROVER_TAG}/stark/*; do
-              sha256sum $file
+              sha256sum $file > $file.sha256
+              echo -n "SHA256SUM for $file"
+              cat $file.sha256
           done
       - name: Sync S3 Bucket
         run: |

diff --git a/bin/install_prover.sh b/bin/install_prover.sh
@@ -87,6 +87,11 @@ for stark_tech in stark/rapidsnark stark/stark_verify stark/stark_verify_final.z
     if [ ! -f "${INSTALL_PREFIX}/${stark_tech}" ]; then
         echo "Downloading ${stark_tech} from ${PROVER_PROVIDER_URL}/${PROVER_VERSION}"
         curl --max-time ${JOB_TIMEOUT} -o "${INSTALL_PREFIX}/${stark_tech}" "$PROVER_PROVIDER_URL/${PROVER_VERSION}/${stark_tech}"
+        if [ -x $(which sha256sum) ]; then
+            echo "Verifying the integrity of ${stark_tech}"
+            sha256sum -c "${INSTALL_PREFIX}/${stark_tech}.sha256"
+            cat "${INSTALL_PREFIX}/${stark_tech}.sha256"
+        fi
     else 
         echo "${INSTALL_PREFIX}/${stark_tech} already exists. Skipping download."
     fi