feat: improve soldeer.lock verification with checksum integrity checks

Author: silvekkk

Cargo.lock

@@ -74,6 +74,7 @@ parking_lot.workspace = true
 regex = { workspace = true, default-features = false }
 semver.workspace = true
 serde_json.workspace = true
+sha2 = "0.10"
 similar = { version = "2", features = ["inline"] }
 solar.workspace = true
 strum = { workspace = true, features = ["derive"] }

crates/forge/Cargo.toml

@@ -23,7 +23,13 @@ use foundry_config::{
     filter::expand_globs,
 };
 use serde::{Deserialize, Serialize};
-use std::{path::PathBuf, process::Command};
+use sha2::{Digest, Sha256};
+use std::{
+    fs,
+    io::Read,
+    path::{Path, PathBuf},
+    process::Command,
+};
 
 foundry_config::merge_impl_figment_convert!(BuildArgs, build);
 
@@ -32,8 +38,8 @@ struct SoldeerLockEntry {
     name: String,
     version: String,
     source: String,
-    #[serde(default, rename = "checksum")]
-    _checksum: Option<String>,
+    #[serde(default)]
+    checksum: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -224,7 +230,7 @@ impl BuildArgs {
         })
     }
 
-    /// Check soldeer.lock file consistency with actual git revisions
+    /// Check soldeer.lock file consistency with checksums and git revisions
     fn check_soldeer_lock_consistency(&self, config: &Config) {
         let soldeer_lock_path = config.root.join("soldeer.lock");
         if !soldeer_lock_path.exists() {
@@ -242,37 +248,100 @@ impl BuildArgs {
         };
 
         for dep in &soldeer_lock.dependencies {
-            if let Some((_, expected_rev)) = dep.source.split_once('#') {
-                let dep_dir_name = format!("{}-{}", dep.name, dep.version);
-                let dep_path = config.root.join("dependencies").join(&dep_dir_name);
-
-                if dep_path.exists() {
-                    let actual_rev = Command::new("git")
-                        .args(["rev-parse", "HEAD"])
-                        .current_dir(&dep_path)
-                        .output();
-
-                    if let Ok(output) = actual_rev
-                        && output.status.success()
+            let dep_dir_name = format!("{}-{}", dep.name, dep.version);
+            let dep_path = config.root.join("dependencies").join(&dep_dir_name);
+
+            if !dep_path.exists() {
+                continue;
+            }
+
+            // Check checksum if available
+            if let Some(expected_checksum) = &dep.checksum
+                && let Ok(actual_checksum) = self.calculate_dependency_checksum(&dep_path)
+                && expected_checksum != &actual_checksum
+            {
+                sh_warn!(
+                    "Dependency '{}' integrity check failed: \n  Expected checksum: {}\n  Actual checksum: {}",
+                    dep.name,
+                    expected_checksum,
+                    actual_checksum
+                ).ok();
+                continue;
+            }
+
+            // For git dependencies, also check revision
+            if let Some((_, expected_rev)) = dep.source.split_once('#')
+                && dep_path.join(".git").exists()
+            {
+                let actual_rev =
+                    Command::new("git").args(["rev-parse", "HEAD"]).current_dir(&dep_path).output();
+
+                if let Ok(output) = actual_rev
+                    && output.status.success()
+                {
+                    let actual_rev = String::from_utf8_lossy(&output.stdout).trim().to_string();
+
+                    if !actual_rev.starts_with(expected_rev)
+                        && !expected_rev.starts_with(&actual_rev)
                     {
-                        let actual_rev = String::from_utf8_lossy(&output.stdout).trim().to_string();
-
-                        if !actual_rev.starts_with(expected_rev)
-                            && !expected_rev.starts_with(&actual_rev)
-                        {
-                            sh_warn!(
-                                "Dependency '{}' revision mismatch: \n  Expected (from soldeer.lock): {}\n  Actual (in {}): {}",
-                                dep.name,
-                                expected_rev,
-                                dep_dir_name,
-                                actual_rev
-                            ).ok();
-                        }
+                        sh_warn!(
+                            "Dependency '{}' revision mismatch: \n  Expected (from soldeer.lock): {}\n  Actual: {}",
+                            dep.name,
+                            expected_rev,
+                            actual_rev
+                        ).ok();
                     }
                 }
             }
         }
     }
+
+    /// Calculate checksum for a dependency directory
+    fn calculate_dependency_checksum(&self, dep_path: &Path) -> Result<String> {
+        let mut hasher = Sha256::new();
+        let mut files = Vec::new();
+
+        // Collect all files recursively, excluding .git directory
+        collect_files_recursive(dep_path, &mut files)?;
+
+        // Sort files for consistent hashing
+        files.sort();
+
+        for file_path in files {
+            // Hash the relative path
+            let relative_path = file_path.strip_prefix(dep_path).unwrap_or(&file_path);
+            hasher.update(relative_path.to_string_lossy().as_bytes());
+
+            // Hash the file contents
+            let mut file = fs::File::open(&file_path)?;
+            let mut buffer = Vec::new();
+            file.read_to_end(&mut buffer)?;
+            hasher.update(&buffer);
+        }
+
+        let result = hasher.finalize();
+        Ok(format!("{result:x}"))
+    }
+}
+
+/// Recursively collect all files in a directory, excluding .git
+fn collect_files_recursive(dir: &Path, files: &mut Vec<PathBuf>) -> Result<()> {
+    if dir.file_name() == Some(std::ffi::OsStr::new(".git")) {
+        return Ok(());
+    }
+
+    for entry in fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+
+        if path.is_dir() {
+            collect_files_recursive(&path, files)?;
+        } else if path.is_file() {
+            files.push(path);
+        }
+    }
+
+    Ok(())
 }
 
 // Make this args a `figment::Provider` so that it can be merged into the `Config`