Integrate verified installation flow (T-302)

core/installer/extractor.go

@@ -2,6 +2,8 @@ package installer
 
 import (
 	"archive/zip"
+	"crypto/sha256"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -43,6 +45,15 @@ type ExtractResult struct {
 	Files          int
 	Bytes          int64
 	EntrypointPath string
+	PayloadFiles   []ExtractedFile
+}
+
+// ExtractedFile is one payload file written to staging after ZIP CRC and
+// length validation. Its digest is calculated from the bytes written there.
+type ExtractedFile struct {
+	Path   string
+	Size   int64
+	SHA256 string
 }
 
 type plannedEntry struct {
@@ -89,7 +100,6 @@ func (extractor Extractor) extract(
 	if err := extractor.limits.validate(); err != nil {
 		return ExtractResult{}, err
 	}
-	fence := effectiveDurability(extractor.durability)
 	normalizedEntrypoint, err := normalizeEntrypoint(entrypoint)
 	if err != nil {
 		return ExtractResult{}, err
@@ -98,9 +108,18 @@ func (extractor Extractor) extract(
 	if err != nil {
 		return ExtractResult{}, err
 	}
+	return extractor.extractPlan(destination, normalizedEntrypoint, plan)
+}
+
+func (extractor Extractor) extractPlan(
+	destination string,
+	entrypoint string,
+	plan []plannedEntry,
+) (result ExtractResult, err error) {
+	fence := effectiveDurability(extractor.durability)
 	destinationRoot, entrypointPath, err := planOutputPaths(
 		destination,
-		normalizedEntrypoint,
+		entrypoint,
 		plan,
 	)
 	if err != nil {
@@ -161,7 +180,11 @@ func (extractor Extractor) extract(
 		if readLimit < math.MaxInt64 {
 			readLimit++
 		}
-		copied, copyErr := io.Copy(output, io.LimitReader(source, readLimit))
+		digest := sha256.New()
+		copied, copyErr := io.Copy(
+			io.MultiWriter(output, digest),
+			io.LimitReader(source, readLimit),
+		)
 		closeSourceErr := source.Close()
 		if copyErr != nil {
 			_ = output.Close()
@@ -194,6 +217,11 @@ func (extractor Extractor) extract(
 		}
 		written += copied
 		result.Files++
+		result.PayloadFiles = append(result.PayloadFiles, ExtractedFile{
+			Path:   entry.outputPath,
+			Size:   copied,
+			SHA256: hex.EncodeToString(digest.Sum(nil)),
+		})
 	}
 	if err := syncStagingTree(fence, destinationRoot); err != nil {
 		return ExtractResult{}, err