* Compare file checksums case-insensitively
Hex digests are case-insensitive, and vendors frequently publish them in
upper case. LoadFileOrURLWithChecksum compared the computed digest --
always lower case, as hex.EncodeToString emits it -- against the
user-supplied value with a plain string comparison, so a correct
upper-case checksum was reported as incorrect.
The only caller is 'cosign initialize --root-checksum', which verifies
the TUF root of trust, so the workaround a user is most likely to reach
for is --force-skip-checksum-validation.
Signed-off-by: Sergey Sannikov <sergey@sannikov.dev>
* Compare the decoded digests instead of their hex spellings
Per review: decoding the given checksum and comparing bytes removes the
case question entirely, and a value that is not valid hex cannot decode
to the digest either, so the existing behaviour for malformed input is
unchanged.
Signed-off-by: Sergey Sannikov <sergey@sannikov.dev>
---------
Signed-off-by: Sergey Sannikov <sergey@sannikov.dev>
4d589ba37b