Compute asset hashes in post_upgrade (#523)

* Compute asset hashes in post_upgrade

This removes the build-time hash computation and make it happen when
`for_each_asset` is called, effectively in `post_upgrade` (and `init`).

The interface is still a bit cumbersome (e.g. `for_each_asset` is still
callback based) but this makes sure that `main.rs` is not changed; the
focus here is the asset hashes. This is the first step in removing
`CANISTER_ID` from the build process; we want to inject it in the assets
directly, and this will change `main.rs` and `for_each_asset`.

I've tested this locally and assets (at least `index.js`) have the same
ic-certificate header as they have on `main`.

* Comment

* Remove sha2 from build dep

* Fix typo

* Grab index.html once

* Simplify hash_content

Co-authored-by: Frederik Rothenberger <[email protected]>

Author: nmattia

src/internet_identity/Cargo.toml

@@ -26,9 +26,6 @@ captcha = { git = 'https://github.com/nmattia/captcha', rev = '4751b6fa4e56229c2
 hex-literal = "0.2.1"
 rand = "0.8.3"
 
-[build-dependencies]
-sha2 = "0.9.1"
-
 [features]
 # the dummy_captcha feature which ensures the captcha string is always "a"
 # (needed for tests)

src/internet_identity/build.rs

@@ -1 +1,87 @@
-include!(concat!(env!("OUT_DIR"), "/assets.rs"));
+// All assets
+//
+// This file describes which assets are used and how (content, content type and content encoding).
+
+use sha2::Digest;
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum ContentEncoding {
+    Identity,
+    GZip,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum ContentType {
+    HTML,
+    JS,
+    ICO,
+    WEBP,
+    SVG
+}
+
+pub fn for_each_asset(mut f: impl FnMut(&'static str, ContentEncoding, ContentType, &'static [u8], &[u8; 32])) {
+
+    let index_html = include_bytes!("../../../dist/index.html");
+
+    let assets: [ (&str, &[u8], ContentEncoding, ContentType); 8] = [
+         ("/",
+            index_html,
+            ContentEncoding::Identity,
+            ContentType::HTML,
+         ),
+         // The FAQ and about pages are the same webapp, but the webapp routes to the correct page
+         (
+             "/faq",
+             index_html,
+             ContentEncoding::Identity,
+             ContentType::HTML,
+         ),
+         (
+             "/about",
+             index_html,
+             ContentEncoding::Identity,
+             ContentType::HTML,
+         ),
+         (
+             "/index.html",
+             index_html,
+             ContentEncoding::Identity,
+             ContentType::HTML,
+         ),
+         (
+             "/index.js",
+             include_bytes!("../../../dist/index.js.gz"),
+             ContentEncoding::GZip,
+             ContentType::JS,
+         ),
+         (
+             "/loader.webp",
+             include_bytes!("../../../dist/loader.webp"),
+             ContentEncoding::Identity,
+             ContentType::WEBP,
+         ),
+         (
+             "/favicon.ico",
+             include_bytes!("../../../dist/favicon.ico"),
+             ContentEncoding::Identity,
+             ContentType::ICO,
+         ),
+         (
+             "/ic-badge.svg",
+             include_bytes!("../../../dist/ic-badge.svg"),
+             ContentEncoding::Identity,
+             ContentType::SVG,
+         ),
+    ];
+
+    for (name, content, encoding, content_type) in assets {
+        let hash = hash_content(content);
+        f(name, encoding, content_type, content, &hash);
+    }
+}
+
+
+// Hash the content of an asset in an `ic_certified_map` friendly way
+fn hash_content(bytes: &[u8]) -> [u8; 32] {
+    sha2::Sha256::digest(bytes).into()
+}