Hashed Modules Loader

wiki

module(..., package.seeall)

local crypto = require 'crypto'

local dtypes = {"md5", "md4", "md2", "sha1", "sha", "sha256", "sha512"}

local function load(modulename)
  -- Find source
  local filename
  local file,hashfile,hashtype
  local errmsg = ""
  for path in string.gmatch(package.path..";", "([^;]*);") do
    filename = string.gsub(path, "%?", (string.gsub(modulename, "%.", "\\")))
    file = io.open(filename, "rb")
    -- If we found a module check if it has a hash file
    if file then
      for _,dtype in ipairs(dtypes) do
        hashfile = io.open(filename.."."..dtype, "rb")
        if hashfile then
          hashtype = dtype
          break
        end
      end
    end
    if hashfile then
      break
    end
    errmsg = errmsg.."\n\tno file '"..filename.."' (signed)"
  end
  if not file then
    return errmsg
  end
  -- Read source file
  local source = file:read("*a")
  -- Read saved hash
  local hash = hashfile:read("*a"):gsub("[^%x]", "")
  -- Check that the saved hash match the file hash
  assert(crypto.evp.digest(hashtype, source)==hash,
    "module "..modulename.." (from file '"..filename.."')"
    .." does not match its "..hashtype.." hash")
  -- Compile and return the module
  return assert(loadstring(source, filename))
end

-- Install the loader so that it's called just before the normal Lua loader
table.insert(package.loaders, 2, load)

You can find that code with sample modules and a test script in [hashedmodules-200705100234.zip].