Incus does not verify combined fingerprint when downloading images from simplestreams servers

@@ -97,6 +97,14 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 	httpTransport.ResponseHeaderTimeout = 30 * time.Second
 	httpClient.Transport = httpTransport
 
+	// Get the image and expand the fingerprint.
+	image, err := r.ssClient.GetImage(fingerprint)
+	if err != nil {
+		return nil, err
+	}
+
+	fingerprint = image.Fingerprint
+
 	// Get the file list
 	files, err := r.ssClient.GetFiles(fingerprint)
 	if err != nil {
@@ -240,6 +248,44 @@ func (r *ProtocolSimpleStreams) GetImageFile(fingerprint string, req ImageFileRe
 		}
 	}
 
+	// Validate the full image hash.
+	//
+	// Normally we'd do that as we download the image to avoid having to
+	// re-read the data, but because the simplestreams allows retries (HTTP to HTTPS),
+	// we don't have a clean reader that can be used for that.
+	//
+	// Another situation where we couldn't do a streaming hash anyway is when processing delta images.
+	hash256 := sha256.New()
+
+	if resp.MetaSize > 0 && req.MetaFile != nil {
+		_, err = req.MetaFile.Seek(0, io.SeekStart)
+		if err != nil {
+			return nil, err
+		}
+
+		_, err := io.Copy(hash256, req.MetaFile)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if resp.RootfsSize > 0 && req.RootfsFile != nil {
+		_, err = req.RootfsFile.Seek(0, io.SeekStart)
+		if err != nil {
+			return nil, err
+		}
+
+		_, err := io.Copy(hash256, req.RootfsFile)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	hash := fmt.Sprintf("%x", hash256.Sum(nil))
+	if hash != fingerprint {
+		return nil, fmt.Errorf("Image fingerprint doesn't match. Got %s expected %s", hash, fingerprint)
+	}
+
 	return &resp, nil
 }
 

@@ -412,8 +412,8 @@ func ImageDownload(ctx context.Context, r *http.Request, s *state.State, op *ope
 		// Download the image
 		var resp *incus.ImageFileResponse
 		request := incus.ImageFileRequest{
-			MetaFile:        io.WriteSeeker(dest),
-			RootfsFile:      io.WriteSeeker(destRootfs),
+			MetaFile:        io.ReadWriteSeeker(dest),
+			RootfsFile:      io.ReadWriteSeeker(destRootfs),
 			ProgressHandler: progress,
 			Canceler:        canceler,
 			DeltaSourceRetriever: func(fingerprint string, file string) string {

@@ -4555,8 +4555,8 @@ func imageImportFromNode(imagesDir string, client incus.InstanceServer, fingerpr
 	defer func() { _ = rootfsFile.Close() }()
 
 	getReq := incus.ImageFileRequest{
-		MetaFile:   io.WriteSeeker(metaFile),
-		RootfsFile: io.WriteSeeker(rootfsFile),
+		MetaFile:   io.ReadWriteSeeker(metaFile),
+		RootfsFile: io.ReadWriteSeeker(rootfsFile),
 	}
 
 	getResp, err := client.GetImageFile(fingerprint, getReq)

@@ -576,8 +576,8 @@ func (c *cmdImageExport) Run(cmd *cobra.Command, args []string) error {
 	}
 
 	req := incus.ImageFileRequest{
-		MetaFile:        io.WriteSeeker(dest),
-		RootfsFile:      io.WriteSeeker(destRootfs),
+		MetaFile:        io.ReadWriteSeeker(dest),
+		RootfsFile:      io.ReadWriteSeeker(destRootfs),
 		ProgressHandler: progress.UpdateProgress,
 	}
 

@@ -502,10 +502,10 @@ type ImageCreateArgs struct {
 // The ImageFileRequest struct is used for an image download request.
 type ImageFileRequest struct {
 	// Writer for the metadata file
-	MetaFile io.WriteSeeker
+	MetaFile io.ReadWriteSeeker
 
 	// Writer for the rootfs file
-	RootfsFile io.WriteSeeker
+	RootfsFile io.ReadWriteSeeker
 
 	// Progress handler (called whenever some progress is made)
 	ProgressHandler func(progress ioprogress.ProgressData)