GH-968: add missing digest functionality to path plugins

protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/plugins/PathProtocPlugin.java

@@ -15,10 +15,12 @@
  */
 package io.github.ascopes.protobufmavenplugin.plugins;
 
+import io.github.ascopes.protobufmavenplugin.digests.Digest;
 import io.github.ascopes.protobufmavenplugin.plexus.KindHint;
 import io.github.ascopes.protobufmavenplugin.utils.DeadCodeGenerated;
 import org.immutables.value.Value.Default;
 import org.immutables.value.Value.Modifiable;
+import org.jspecify.annotations.Nullable;
 
 
 /**
@@ -37,6 +39,8 @@ public abstract non-sealed class PathProtocPlugin implements ProtocPlugin {
 
   public abstract String getName();
 
+  public abstract @Nullable Digest getDigest();
+
   @Default.Boolean(false)
   public abstract boolean isOptional();
 

protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/plugins/ProtocPluginResolver.java

@@ -42,6 +42,7 @@
 import javax.inject.Named;
 import org.apache.maven.execution.scope.MojoExecutionScoped;
 import org.eclipse.sisu.Description;
+import org.jspecify.annotations.Nullable;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -154,9 +155,7 @@ private Optional<ResolvedProtocPlugin> resolveBinaryMavenPlugin(
     log.debug("Resolving binary Maven protoc plugin \"{}\"", plugin);
 
     var path = artifactPathResolver.resolveArtifact(plugin);
-
     var id = computeId(path, index);
-
     return Optional.of(createResolvedProtocPlugin(plugin, defaultOutputDirectory, path, id));
   }
 
@@ -177,8 +176,8 @@ private Optional<ResolvedProtocPlugin> resolveBinaryPathPlugin(
         "No plugin named \"" + plugin.getName() + "\" was found on the system path"
     ));
 
+    verifyDigest(plugin.getName(), path, plugin.getDigest());
     var id = computeId(path, index);
-
     return Optional.of(createResolvedProtocPlugin(plugin, defaultOutputDirectory, path, id));
   }
 
@@ -199,21 +198,8 @@ private Optional<ResolvedProtocPlugin> resolveBinaryUrlPlugin(
         "Plugin at " + plugin.getUrl() + " does not exist"
     ));
 
-    if (plugin.getDigest() != null) {
-      log.debug("Verifying digest of \"{}\" against \"{}\"", plugin.getUrl(), plugin.getDigest());
-
-      try (var is = new BufferedInputStream(Files.newInputStream(path))) {
-        plugin.getDigest().verify(is);
-      } catch (IOException ex) {
-        throw new ResolutionException(
-            "Failed to compute digest of \"" + plugin.getUrl() + "\": " + ex,
-            ex
-        );
-      }
-    }
-
+    verifyDigest(plugin.getUrl().toString(), path, plugin.getDigest());
     var id = computeId(path, index);
-
     return Optional.of(createResolvedProtocPlugin(plugin, defaultOutputDirectory, path, id));
   }
 
@@ -275,4 +261,23 @@ private ResolvedProtocPlugin createResolvedProtocPlugin(
   private String computeId(Path path, int index) {
     return index + "_" + Digest.compute("SHA-1", path.toString()).toHexString();
   }
+
+  private void verifyDigest(String name, Path file, @Nullable Digest digest)
+      throws ResolutionException {
+
+    if (digest == null) {
+      return;
+    }
+
+    log.debug("Verifying digest of \"{}\" against \"{}\"", name, digest);
+
+    try (var is = new BufferedInputStream(Files.newInputStream(file))) {
+      digest.verify(is);
+    } catch (IOException ex) {
+      throw new ResolutionException(
+          "Failed to compute digest of \"" + name + "\": " + ex,
+          ex
+      );
+    }
+  }
 }

protobuf-maven-plugin/src/site/markdown/using-protoc-plugins.md

@@ -107,6 +107,7 @@ Path plugins should have the `kind` attribute set to `path`.
 | Property                    | Type           | Default           | Description             |
 |:----------------------------|:---------------|:------------------|:------------------------|
 | `name`                      | `String`       |                   | The name of the executable on the system path. On Windows, this must not include the file extension. |
+| `digest`                    | `String`       | unspecified       | If specified, the contents of the plugin binary will be validated against the digest. E.g. `sha1:9478159bef3d3c6fe5c2fe084a74ce5e92b6c070` |
 | `optional`                  | `boolean`      | `false`           | If `true`, then any failure to fetch the resource will not halt the build. Use this if some platforms lack support for the plugin. |
 | `options`                   | `String`       | unspecified       | Options to pass to the plugin via `protoc`'s options API. |
 | `order`                     | `int`          | `0`               | Relative order to run the plugin. |