From 5320389ea42877fd049deffedebabe1aa55d70dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Garapich?= <michal@garapich.pl>
Date: Thu, 21 Apr 2022 16:37:24 +0200
Subject: [PATCH] fix(tf2-sourcemod): verify download checksums (#45)

---
 packages/tf2-sourcemod/Dockerfile   | 16 +++++++++++-----
 packages/tf2-sourcemod/checksum.md5 |  2 ++
 2 files changed, 13 insertions(+), 5 deletions(-)
 create mode 100644 packages/tf2-sourcemod/checksum.md5

diff --git a/packages/tf2-sourcemod/Dockerfile b/packages/tf2-sourcemod/Dockerfile
index 7da9318..4241344 100644
--- a/packages/tf2-sourcemod/Dockerfile
+++ b/packages/tf2-sourcemod/Dockerfile
@@ -1,15 +1,21 @@
 FROM melkortf/tf2-base:latest
 LABEL maintainer="garrappachc@gmail.com"
 
+COPY checksum.md5 .
+
 ARG METAMOD_TARBALL_FILE_NAME=mmsource-1.11.0-git1145-linux.tar.gz
-ARG METAMOD_TARBALL_URL=https://mms.alliedmods.net/mmsdrop/1.11/${METAMOD_TARBALL_FILE_NAME}
+ARG METAMOD_MAJOR_VERSION=1.11
+ARG METAMOD_TARBALL_URL=https://mms.alliedmods.net/mmsdrop/${METAMOD_MAJOR_VERSION}/${METAMOD_TARBALL_FILE_NAME}
 
 ARG SOURCEMOD_TARBALL_FILE_NAME=sourcemod-1.10.0-git6528-linux.tar.gz
-ARG SOURCEMOD_TARBALL_URL=https://sm.alliedmods.net/smdrop/1.10/${SOURCEMOD_TARBALL_FILE_NAME}
+ARG SOURCEMOD_MAJOR_VERSION=1.10
+ARG SOURCEMOD_TARBALL_URL=https://sm.alliedmods.net/smdrop/${SOURCEMOD_MAJOR_VERSION}/${SOURCEMOD_TARBALL_FILE_NAME}
 
 RUN wget -nv "${METAMOD_TARBALL_URL}" \
-  && tar xf "${METAMOD_TARBALL_FILE_NAME}" -C "${SERVER_DIR}/tf" \
-  && rm -f "${METAMOD_TARBALL_FILE_NAME}" \
   && wget -nv "${SOURCEMOD_TARBALL_URL}" \
+  && md5sum -c checksum.md5 \
+  && tar xf "${METAMOD_TARBALL_FILE_NAME}" -C "${SERVER_DIR}/tf" \
   && tar xf "${SOURCEMOD_TARBALL_FILE_NAME}" -C "${SERVER_DIR}/tf" \
-  && rm -f "${SOURCEMOD_TARBALL_FILE_NAME}"
+  && rm "${METAMOD_TARBALL_FILE_NAME}" \
+  && rm "${SOURCEMOD_TARBALL_FILE_NAME}" \
+  && rm checksum.md5
diff --git a/packages/tf2-sourcemod/checksum.md5 b/packages/tf2-sourcemod/checksum.md5
new file mode 100644
index 0000000..648149d
--- /dev/null
+++ b/packages/tf2-sourcemod/checksum.md5
@@ -0,0 +1,2 @@
+35c6558bf7e765ea3a8f55ad3c2533b3  mmsource-1.11.0-git1145-linux.tar.gz
+cf820f8b9f9a53263ab5bee26a8ab8f8  sourcemod-1.10.0-git6528-linux.tar.gz