chore(deps): bump the library-deps group in /library with 5 updates (#332)

* chore(deps): bump the library-deps group in /library with 5 updates

Updates the requirements on [sha2](https://github.com/RustCrypto/hashes), [zip](https://github.com/zip-rs/zip2), [mockall](https://github.com/asomers/mockall), [mock_instant](https://github.com/museun/mock_instant) and [cbindgen](https://github.com/mozilla/cbindgen) to permit the latest version.

Updates `sha2` to 0.11.0
- [Commits](https://github.com/RustCrypto/hashes/compare/streebog-v0.11.0-pre.0...sha2-v0.11.0)

Updates `zip` to 8.5.0
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zip-rs/zip2/compare/v3.0.0...v8.5.0)

Updates `mockall` to 0.14.0
- [Changelog](https://github.com/asomers/mockall/blob/master/CHANGELOG.md)
- [Commits](https://github.com/asomers/mockall/compare/v0.13.1...v0.14.0)

Updates `mock_instant` to 0.6.0
- [Commits](https://github.com/museun/mock_instant/compare/v0.5.1...v0.6.0)

Updates `cbindgen` to 0.29.2
- [Release notes](https://github.com/mozilla/cbindgen/releases)
- [Changelog](https://github.com/mozilla/cbindgen/blob/main/CHANGES)
- [Commits](https://github.com/mozilla/cbindgen/compare/0.28.0...0.29.2)

---
updated-dependencies:
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  dependency-group: library-deps
- dependency-name: zip
  dependency-version: 8.5.0
  dependency-type: direct:production
  dependency-group: library-deps
- dependency-name: mockall
  dependency-version: 0.14.0
  dependency-type: direct:production
  dependency-group: library-deps
- dependency-name: mock_instant
  dependency-version: 0.6.0
  dependency-type: direct:production
  dependency-group: library-deps
- dependency-name: cbindgen
  dependency-version: 0.29.2
  dependency-type: direct:production
  dependency-group: library-deps
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: adapt sha2 0.11 hashing (no io::Write impl)

* refactor: reuse cache::hash_file in check_hash

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Eric Seidel <eric@shorebird.dev>

library/Cargo.toml

@@ -41,10 +41,10 @@ ring = "0.17.8"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.93"
 # For computing hashes of patch files for validation.
-sha2 = "0.10.6"
+sha2 = "0.11.0"
 uuid = { version = "1.18.1", features = ["v4"] }
 # For decompressing .apk files.
-zip = { version = "3.0.0", default-features = false, features = ["deflate"] }
+zip = { version = "8.5.1", default-features = false, features = ["deflate"] }
 
 [target.'cfg(target_os = "android")'.dependencies]
 # For logging to Android logcat.
@@ -62,9 +62,9 @@ oslog = "0.2.0"
 simple_logger = "5.0.0"
 
 [dev-dependencies]
-mockall = "0.13.1"
+mockall = "0.14.0"
 mockito = "1.2.0"
-mock_instant = "0.5.1"
+mock_instant = "0.6.0"
 # Gives #[serial] attribute for locking all of our shorebird_init
 # tests to a single thread so they don't conflict with each other.
 serial_test = "3.2.0"
@@ -72,4 +72,4 @@ tempfile = "3"
 
 # <https://github.com/eqrion/cbindgen/blob/master/docs.md#buildrs>
 [build-dependencies]
-cbindgen = "0.28.0"
+cbindgen = "0.29.2"

library/src/cache/mod.rs

@@ -3,6 +3,7 @@ mod patch_manager;
 mod signing;
 pub mod updater_state;
 
+pub use signing::hash_file;
 pub use updater_state::UpdaterState;
 
 /// The public interface for talking about patches to the Cache.

library/src/cache/signing.rs

@@ -6,10 +6,18 @@ use std::path::Path;
 /// Reads the file at `path` and returns the SHA-256 hash of its contents as a String.
 pub fn hash_file<P: AsRef<Path>>(path: P) -> Result<String> {
     use sha2::{Digest, Sha256}; // `Digest` is needed for `Sha256::new()`;
+    use std::io::Read;
 
     let mut file = std::fs::File::open(path)?;
     let mut hasher = Sha256::new();
-    std::io::copy(&mut file, &mut hasher)?;
+    let mut buf = [0u8; 8192];
+    loop {
+        let n = file.read(&mut buf)?;
+        if n == 0 {
+            break;
+        }
+        hasher.update(&buf[..n]);
+    }
     let hash = hasher.finalize();
     Ok(hex::encode(hash))
 }

library/src/updater.rs

@@ -296,19 +296,11 @@ pub fn check_for_downloadable_update(channel: Option<&str>) -> anyhow::Result<bo
 }
 
 fn check_hash(path: &Path, expected_string: &str) -> anyhow::Result<()> {
-    use sha2::{Digest, Sha256}; // `Digest` is needed for `Sha256::new()`;
-
-    let expected = hex::decode(expected_string).context("Invalid hash string from server.")?;
-
-    // Based on guidance from:
-    // <https://github.com/RustCrypto/hashes#hashing-readable-objects>
-
-    let mut file = fs::File::open(path).with_file_context(FileOperation::ReadFile, path)?;
-    let mut hasher = Sha256::new();
-    std::io::copy(&mut file, &mut hasher).with_file_context(FileOperation::ReadFile, path)?;
-    // Check that the length from copy is the same as the file size?
-    let hash = hasher.finalize();
-    let hash_matches = hash.as_slice() == expected;
+    // Validate the expected string is a hex-encoded hash.
+    hex::decode(expected_string).context("Invalid hash string from server.")?;
+    let hash = crate::cache::hash_file(path)
+        .with_context(|| format!("Failed to hash file: {:?}", path))?;
+    let hash_matches = hash == expected_string;
     // This is a common error for developers.  We could avoid it entirely
     // by sending the hash of `libapp.so` to the server and having the
     // server only send updates when the hash matches.
@@ -321,7 +313,7 @@ fn check_hash(path: &Path, expected_string: &str) -> anyhow::Result<()> {
             binary. Path: {:?}, expected: {}, got: {}",
             path,
             expected_string,
-            hex::encode(hash)
+            hash
         );
     }
     shorebird_debug!("Hash match: {:?}", path);