Validate hash_sha256 checksum on .crx update.

extensions/common/update_manifest.cc

Index: extensions/common/update_manifest.cc
diff --git a/extensions/common/update_manifest.cc b/extensions/common/update_manifest.cc
index 26d794f11f4ec9f25262169d98082473399ad41e..1446b955d8b6331882cf7e5441cf8241a327fade 100644
--- a/extensions/common/update_manifest.cc
+++ b/extensions/common/update_manifest.cc
@@ -189,7 +189,7 @@ static bool ParseSingleAppTag(xmlNode* app_node, xmlNs* xml_namespace,
 
   // package_hash is optional. It is only required for blacklist. It is a

[asargent_no_longer_on_chrome, 2015/02/03 00:42:55]

nit: remove the "It is only required for blacklist." part of this comment, since
it is now outdated. 

(We used to fetch the extension blacklist through the extension autoupdate
system, but we now use the Safe Browsing infrastructure code instead)

BTW, I assume you've verified that the Omaha server output actually already
includes this hash_sha256 attribute?

[Ivan Podogov, 2015/02/03 07:43:55]

Yes, although it's not always correct (as I've already told you when discussed
in person), that's why command-line option and histogram were added.

   // sha256 hash of the package in hex format.
-  result->package_hash = GetAttribute(updatecheck, "hash");
+  result->package_hash = GetAttribute(updatecheck, "hash_sha256");
 
   int size = 0;
   if (base::StringToInt(GetAttribute(updatecheck, "size"), &size)) {