4 files changed, 87 insertions, 1 deletions
diff --git a/src/build.c b/src/build.c
index 243f3bc..9463136 100644
--- a/src/build.c
+++ b/src/build.c
@@ -39,7 +39,11 @@ int pow_package_build(pow_package *pkg) {
 
   printf("building package %s\n", pkg->name);
 
-  pow_download_source(pkg->sources[0], tmp_path);
+  if (pow_download_source(pkg->sources[0], tmp_path)) {
+    printf("failed to get sources\n");
+
+    return 1;
+  }
 
   lua_getfield(pkg->L, -1, "build");
 
diff --git a/src/download.c b/src/download.c
index a833932..fb5746d 100644
--- a/src/download.c
+++ b/src/download.c
@@ -1,3 +1,4 @@
+#include "hash.h"
 #include "package.h"
 
 #include "curl/curl.h"
@@ -63,5 +64,14 @@ int pow_download_source(pow_package_source *src, const char *prefix) {
     return 1;
   }
 
+  if (pow_check_blake2b_hash(full_path, src->hash)) {
+    printf("hash mismatch. something is going wrong with downloading the file "
+           "or it may be tampered with.\n");
+
+    return 1;
+  }
+
+  printf("hash verification succeeded, going through.");
+
   return 0;
 }
diff --git a/src/hash.c b/src/hash.c
new file mode 100644
index 0000000..2cb0851
--- /dev/null
+++ b/src/hash.c
@@ -0,0 +1,71 @@
+#include "hash.h"
+
+#include <blake2.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int pow_check_blake2b_hash(char *path, char *target_hash) {
+  FILE *fp = fopen(path, "rb");
+
+  if (!fp) {
+    printf("failed to open file to check hash\n");
+
+    return 1;
+  }
+
+  fseek(fp, 0, SEEK_END);
+  long fsize = ftell(fp);
+  fseek(fp, 0, SEEK_SET);
+
+  if (fsize < 0) {
+    printf("error: ftell\n");
+
+    fclose(fp);
+
+    return 1;
+  }
+
+  char *buf = NULL;
+
+  if (fsize > 0) {
+    buf = malloc((size_t)fsize);
+
+    if (!buf) {
+      fprintf(stderr, "out of memory\n");
+      fclose(fp);
+      return 1;
+    }
+
+    if (fread(buf, 1, (size_t)fsize, fp) != (size_t)fsize) {
+      fprintf(stderr, "read error\n");
+      free(buf);
+      fclose(fp);
+      return 1;
+    }
+  }
+
+  fclose(fp);
+
+  uint8_t digest[BLAKE2B_OUTBYTES];
+  if (blake2b(digest, buf, NULL, BLAKE2B_OUTBYTES, (size_t)fsize, 0) != 0) {
+    fprintf(stderr, "blake2b failed\n");
+    free(buf);
+    return 1;
+  }
+
+  free(buf);
+
+  char hex[BLAKE2B_OUTBYTES * 2 + 1];
+  for (size_t i = 0; i < BLAKE2B_OUTBYTES; i++) {
+    snprintf(&hex[i * 2], 3, "%02x", digest[i]);
+  }
+  hex[BLAKE2B_OUTBYTES * 2] = '\0';
+
+  if (!target_hash || strcmp(hex, target_hash) != 0) {
+    return 1;
+  }
+
+  return 0;
+}
diff --git a/src/hash.h b/src/hash.h
new file mode 100644
index 0000000..88e3df0
--- /dev/null
+++ b/src/hash.h
@@ -0,0 +1 @@
+int pow_check_blake2b_hash(char *path, char *target_hash);