Validate hash_sha256 checksum on .crx update.

extensions/common/update_manifest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/update_manifest.h"
 
 #include <algorithm>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/stl_util.h"
@@ skipping 169 matching lines @@
   if (result->browser_min_version.length()) {
     Version browser_min_version(result->browser_min_version);
     if (!browser_min_version.IsValid()) {
       *error_detail = "Invalid prodversionmin: '";
       *error_detail += result->browser_min_version;
       *error_detail += "'.";
       return false;
     }
   }
 
-  // package_hash is optional. It is only required for blacklist. It is a
-  // sha256 hash of the package in hex format.
-  result->package_hash = GetAttribute(updatecheck, "hash");
+  // package_hash is optional. It is a sha256 hash of the package in hex
+  // format.
+  result->package_hash = GetAttribute(updatecheck, "hash_sha256");
 
   int size = 0;
   if (base::StringToInt(GetAttribute(updatecheck, "size"), &size)) {
     result->size = size;
   }
 
   // package_fingerprint is optional. It identifies the package, preferably
   // with a modified sha256 hash of the package in hex format.
   result->package_fingerprint = GetAttribute(updatecheck, "fp");
 
@@ skipping 73 matching lines @@
     std::string error;
     if (!ParseSingleAppTag(apps[i], gupdate_ns, &current, &error)) {
       ParseError("%s", error.c_str());
     } else {
       results_.list.push_back(current);
     }
   }
 
   return true;
 }