Complete refactor of fetch.py/updatecheck.py

code/client/munkilib/fetch.py

@@ -373,7 +373,8 @@ def curl(url, destinationpath, onlyifnewer=False, etag=None, resume=False,
 
 def getResourceIfChangedAtomically(url, destinationpath,
                                  message=None, resume=False,
-                                 expected_hash=None):
+                                 expected_hash=None,
+                                 verify=False):
     """Gets file from a URL.
        Checks first if there is already a file with the necessary checksum.
        Then checks if the file has changed on the server, resuming or
@@ -397,16 +398,16 @@ def getResourceIfChangedAtomically(url, destinationpath,
         if not xattr_hash:
             xattr_hash = writeCachedChecksum(destinationpath)
         if xattr_hash == expected_hash:
-            # File is already current, no change.
+            #File is already current, no change.
             return False
         elif munkicommon.pref('PackageVerificationMode').lower() in \
-                                                    ['hash_strict', 'hash']:
+                                                    ['hash_strict','hash']:
             try:
                 os.unlink(destinationpath)
             except OSError:
                 pass
         munkicommon.log('Cached payload does not match hash in catalog, '
-                'will check if changed and redownload: %s' % destinationpath)                
+                'will check if changed and redownload: %s' % destinationpath)
         #continue with normal if-modified-since/etag update methods.
 
     url_parse = urlparse.urlparse(url)
@@ -421,6 +422,19 @@ def getResourceIfChangedAtomically(url, destinationpath,
         raise MunkiDownloadError(
                 'Unsupported scheme for %s: %s' % (url, url_parse.scheme))
 
+    if changed and verify:
+        (verify_ok, fhash) = verifySoftwarePackageIntegrity(destinationpath,
+                                                          expected_hash,
+                                                          always_hash=True)
+        if not verify_ok:
+            try:
+                os.unlink(destinationpath)
+            except OSError:
+                pass
+            raise PackageVerificationError()
+        if fhash:
+            writeCachedChecksum(destinationpath, fhash=fhash)
+
     return changed
 
 

code/client/munkilib/updatecheck.py

@@ -734,7 +734,7 @@ def download_installeritem(item_pl, installinfo, uninstalling=False):
     dl_message = 'Downloading %s...' % pkgname
     expected_hash = item_pl.get(item_hash_key, None)
     try:
-        changed = fetch.getResourceIfChangedAtomically(pkgurl, destinationpath,
+        unused_x = fetch.getResourceIfChangedAtomically(pkgurl, destinationpath,
                                                     resume=True,
                                                     message=dl_message,
                                                     expected_hash=expected_hash,
@@ -1644,6 +1644,7 @@ def processInstall(manifestitem, cataloglist, installinfo):
 
 INFO_OBJECT = {}
 def makePredicateInfoObject():
+    '''Builds our info object used for predicate comparisons'''
     if INFO_OBJECT:
         return
     for key in MACHINE.keys():
@@ -2323,7 +2324,7 @@ def get_hardware_info():
     proc = subprocess.Popen(cmd, shell=False, bufsize=-1,
                             stdin=subprocess.PIPE,
                             stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    (output, error) = proc.communicate()
+    (output, unused_error) = proc.communicate()
     try:
         plist = FoundationPlist.readPlistFromString(output)
         # system_profiler xml is an array
@@ -2331,7 +2332,7 @@ def get_hardware_info():
         items = sp_dict['_items']
         sp_hardware_dict = items[0]
         return sp_hardware_dict
-    except Exception, e:
+    except Exception:
         return {}