Validate hash_sha256 checksum on .crx update.

chrome/browser/extensions/sandboxed_unpacker.h

Index: chrome/browser/extensions/sandboxed_unpacker.h
diff --git a/chrome/browser/extensions/sandboxed_unpacker.h b/chrome/browser/extensions/sandboxed_unpacker.h
index 60a5bbdd4aa0b517857e283c22c11b4bcc92bb2a..71056641f6bf5feba9ad4fd1b671756febcd60f7 100644
--- a/chrome/browser/extensions/sandboxed_unpacker.h
+++ b/chrome/browser/extensions/sandboxed_unpacker.h
@@ -80,6 +80,7 @@ class SandboxedUnpacker : public content::UtilityProcessHostClient {
   // is done in a sandboxed subprocess. Otherwise, it is done in-process.
   SandboxedUnpacker(
       const base::FilePath& crx_path,
+      const std::string& package_hash,
       Manifest::Location location,
       int creation_flags,
       const base::FilePath& extensions_dir,
@@ -126,6 +127,7 @@ class SandboxedUnpacker : public content::UtilityProcessHostClient {
     CRX_SIGNATURE_INVALID,
     CRX_SIGNATURE_VERIFICATION_INITIALIZATION_FAILED,
     CRX_SIGNATURE_VERIFICATION_FAILED,
+    CRX_HASH_VERIFICATION_FAILED,
 
     // SandboxedUnpacker::RewriteManifestFile()
     ERROR_SERIALIZING_MANIFEST_JSON,
@@ -202,6 +204,12 @@ class SandboxedUnpacker : public content::UtilityProcessHostClient {
   // The path to the CRX to unpack.
   base::FilePath crx_path_;
 
+  // The package hash that was reported from the Web Store.
+  std::string package_hash_;
+
+  // Whether we need to check the .crx hash sum.
+  bool check_crx_hash_;
+
   // Our client.
   scoped_refptr<SandboxedUnpackerClient> client_;