pub fn check_integrity(value: &str, bytes: &[u8]) -> Result<(), IntegrityError>Expand description
Checks bytes against an import’s integrity value.
The ifcx_alpha draft declares integrity?: string on an import and
defines no format; upstream’s providers leave checking as a TODO and no
upstream example sets the field. This crate reads it as W3C Subresource
Integrity metadata: one or more whitespace-separated <alg>-<base64>
tokens, where <alg> is sha256, sha384, or sha512 and <base64> is
the standard, padded base64 digest of the layer’s bytes exactly as the
resolver returns them. As in SRI, only tokens of the strongest algorithm
present count, and one matching token suffices; ?options after a digest
are ignored.
Unlike SRI, which treats unusable metadata as absent, a value that is
empty, malformed, or names only unknown algorithms is an error, so a layer
is never loaded unchecked when its importer asked for a check. Built
without the integrity feature, every value fails with
IntegrityError::Unavailable for the same reason.
use openbim_ifcx::layers::check_integrity;
// sha256 of the empty input.
let value = "sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
assert!(check_integrity(value, b"").is_ok());
assert!(check_integrity(value, b"x").is_err());