[Feature] Get the checksum of the VSIX file from the API

[amvanbaren]

Fixes #311

Testing steps

• Open this PR in gitpod: https://gitpod.io/#https://github.com/eclipse/openvsx/pull/678
• Wait for the workspace to initialize. Once the publisher terminal window has published all test extensions it is done.
• Open a new browser tab and get an extension: https://8080-{GITPOD_WORKSPACE_ID}.gitpod.io/api/{NAMESPACE}/{EXTENSION}/{VERSION}. You can get namespace, extension, version info from the publisher terminal window. GITPOD_WORKSPACE_ID you can find in the browser location bar.
  
• The response should contain files.sha256.
• Open a new browser tab and get sha256 checksum directly: https://8080-{GITPOD_WORKSPACE_ID}.gitpod.io/api/{NAMESPACE}/{EXTENSION}/{VERSION}/file/sha256

[amvanbaren]

@ShamrockLee Do you need a file with just the hash or a file in the sha256sum format?

[ShamrockLee]

@amvanbaren The hash is all I need.

BTW, how would user get the hash when this PR gets merged?

[amvanbaren]

@amvanbaren The hash is all I need.

BTW, how would user get the hash when this PR gets merged?

The checksum file is part of the files section in an Extension JSON response. files.download is the download url. files.checksum is the checksum url.

You can also directly get the checksum file: /api/{namespace}/{extension}/{version}/{targetPlatform}/file/checksum. targetPlatform is optional. version can also be an alias like pre-release or latest.

[ShamrockLee]

Sounds great!

It would be even better to mark the hash output in a per-algorithm manner, such as files.sha256 instead of files.checksum in case an algorithm is considered vulnerable in the future.

[amvanbaren]

@ShamrockLee do you have time to test this PR?

[ShamrockLee]

@amvanbaren How do I test this? (Sorry for being n00b.)

I'll try it this weekend.

[amvanbaren]

@amvanbaren How do I test this?

I've updated the testing steps. Hope that helps.

[ShamrockLee]

Tested, and It works.

BTW, the GitPot test setup you provide seems to default to platform win32-x64 when the platform is not specified, and the universal platform, which is usually the default, is not available.

[amvanbaren]

Tested, and It works.

Great! Thank you for testing.

BTW, the GitPot test setup you provide seems to default to platform win32-x64 when the platform is not specified, and the universal platform, which is usually the default, is not available.

You mean the /api/{namespace}/{extension}/{version} endpoint?

[ShamrockLee]

BTW, the GitPot test setup you provide seems to default to platform win32-x64 when the platform is not specified, and the universal platform, which is usually the default, is not available.

You mean the /api/{namespace}/{extension}/{version} endpoint?

Yes.

By saying "the universal is not available", I mean that /api/{namespace}/{extension}/universal/{version} is not available.

[amvanbaren]

Ok, that's how the /api/{namespace}/{extension}/{version} endpoint works. It tries to get the universal version first and uses other target platforms as a fallback. The fallback target platforms are always in the same order, so you don't get win32-x64 the first time and then the next time linux-x64 for the same API call.
However, the /api/{namespace}/{extension}/{targetPlatform}/{version} endpoint returns a 404 when you try to get the universal version of the same extension.

[ShamrockLee]

So, IIUC, you don't have the universal packages in the test setup. Is that right? For example, package such as bbenoist.Nix are not available as they only provide the universal binary.

[amvanbaren]

So, IIUC, you don't have the universal packages in the test setup. Is that right? For example, package such as bbenoist.Nix are not available as they only provide the universal binary.

The test setup only has a limited amount of packages. They can be found here: https://github.com/eclipse/openvsx/blob/master/server/test-extensions.gradle