Add SHA256 verification of msttcore-fonts

home/bin/fedora-setup

@@ -35,6 +35,8 @@ Themes:
 http://sh.kirsle.net/
 """
 
+import hashlib
+import os
 import subprocess
 
 class Application(object):
@@ -52,8 +54,19 @@ class Application(object):
             self.shell("sudo dnf install --nogpgcheck http://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm http://download1.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm")
 
         # Microsoft core fonts and Emoji support.
-        if not self.test("rpm -q msttcore-fonts"):
-            self.shell("sudo dnf install http://rpm.kirsle.net/any/rpm/msttcore-fonts-2.0-3.noarch.rpm")
+        if not self.test("rpm -q msttcore-fonts") or True:
+            # The fonts aren't signed, so verify their checksum.
+            self.shell("wget -O /tmp/msttcore-fonts.rpm https://rpm.kirsle.net/any/rpm/msttcore-fonts-2.0-3.noarch.rpm")
+            expect_sum = "a20ecca993827d10bb51118a0cfdf8a1e65f161a78361bee865a138ca5a4f43f"
+            if self.sha256sum("/tmp/msttcore-fonts.rpm") != expect_sum:
+                print("!!! WARNING !!!")
+                print("The SHA256 hash of msttcore-fonts doesn't match what I expected!")
+                print("Expected: {}".format(expect_sum))
+                print("     Got: {}".format(self.sha256sum("/tmp/msttcore-fonts.rpm")))
+                input("Press any key to continue. . .")
+            else:
+                self.shell("sudo dnf install /tmp/msttcore-fonts.rpm")
+            os.unlink("/tmp/msttcore-fonts.rpm")
         self.install("gdouros-symbola-fonts")
 
         # Themes
@@ -108,6 +121,13 @@ class Application(object):
         except subprocess.CalledProcessError:
             return False
 
+    def sha256sum(self, file):
+        """Get the SHA256 checksum of a file."""
+        m = hashlib.sha256()
+        with open(file, 'rb') as fh:
+            m.update(fh.read())
+        return m.hexdigest()
+
 if __name__ == "__main__":
     app = Application()
     app.main()