Merge lp:~alecu/unity-scope-click/verify-sha512 into lp:unity-scope-click/devel

[Alejandro J. Cura]

Pass the sha512 hash from the details webservice to download manager

*********** READY FOR REVIEW! *********

Ignore the "still needs more testing message", that's done:

I've refactored a bit of preview.cpp to add proper unit testing to this branch, and have tested the successful verification of the hash and installation in staging with the app that already has the matching hash (demo4), and with some others where the verification fails.

[Alejandro J. Cura (alecu)]

**** STILL NEEDS MORE TESTING *****

I'm setting the branch to Needs Review so Jenkins builds it, and I can test it on the device, but it's not ready to land until more tests are added and until all apps in production have proper hashes.

review: Needs Fixing

[lp:~alecu/unity-scope-click/verify-sha512]

394. By Alejandro J. Cura on 2014-08-11

Merged with tip of /devel

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:393
http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-ci/260/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-amd64-ci/235
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-armhf-ci/234
        deb: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-armhf-ci/234/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-i386-ci/234

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/unity-team-unity-scope-click-devel-ci/260/rebuild

review: Approve (continuous-integration)

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:394
http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-ci/261/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-amd64-ci/236
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-armhf-ci/235
        deb: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-armhf-ci/235/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-i386-ci/235

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/unity-team-unity-scope-click-devel-ci/261/rebuild

review: Approve (continuous-integration)

[lp:~alecu/unity-scope-click/verify-sha512]

395. By Alejandro J. Cura on 2014-08-13

Refactoring in preview.cpp to accomodate new tests

396. By Alejandro J. Cura on 2014-08-13

Add lp bug

[Alejandro J. Cura (alecu)]

*********** READY FOR REVIEW! *********

I've refactored a bit of preview.cpp to add proper unit testing to this branch, and have tested the successful verification of the hash and installation in staging with the app that already has the matching hash (demo4), and with some others where the verification fails.

review: Abstain

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:396
http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-ci/266/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-amd64-ci/241
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-armhf-ci/240
        deb: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-armhf-ci/240/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/unity-team-unity-scope-click-devel-utopic-i386-ci/240

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/unity-team-unity-scope-click-devel-ci/266/rebuild

review: Approve (continuous-integration)

[dobey (dobey)]

I'm approving this, as the code looks ok, and it isn't breaking install of packages on production, nor the purchasing of an app. However, I was unable to get a clear verification of what happens when a package has an invalid hash.

review: Approve

[Paweł Stołowski (stolowski)]

Code looks good but yeah, I second Rodney's question: what happens when hash is invalid? Will we report a download failure?

review: Needs Information

[Alejandro J. Cura (alecu)]

> Code looks good but yeah, I second Rodney's question: what happens when hash
> is invalid? Will we report a download failure?

There's no way to distinguish a wrong hash, from a good hash but the wrong download (ie, because some cache is serving the wrong content, or with some flipped bits).
That's a failure in the download and in many cases it's a retryable error, so I think the current error shown by the scope is ok, but I agree that the wording could be improved.

[Alejandro J. Cura (alecu)]

The "demo4" app in staging now has an incorrect hash, so this case can be better tested.

[Paweł Stołowski (stolowski)]

Ok, works fine on the phone. +1

review: Approve

=== modified file 'libclickscope/click/download-manager.cpp'
--- libclickscope/click/download-manager.cpp	2014-06-20 03:23:40 +0000
+++ libclickscope/click/download-manager.cpp	2014-08-13 14:49:17 +0000
@@ -54,8 +54,7 @@
 
 static const QString DOWNLOAD_COMMAND = CLICK_INSTALL_HELPER;
 
-static const QString DOWNLOAD_MANAGER_DO_NOT_HASH = "";
-static const QString DOWNLOAD_MANAGER_IGNORE_HASH_ALGORITHM = "";
+static const QString DOWNLOAD_MANAGER_SHA512 = "sha512";
 }
 
 struct click::DownloadManager::Private
@@ -78,6 +77,7 @@
     QSharedPointer<udm::Manager> systemDownloadManager;
     QSharedPointer<click::network::Reply> reply;
     QString downloadUrl;
+    QString download_sha512;
     QString package_name;
 };
 
@@ -121,7 +121,7 @@
 click::DownloadManager::~DownloadManager(){
 }
 
-void click::DownloadManager::startDownload(const QString& downloadUrl, const QString& package_name)
+void click::DownloadManager::startDownload(const QString& downloadUrl, const QString& download_sha512, const QString& package_name)
 {
     impl->package_name = package_name;
 
@@ -133,7 +133,7 @@
     QObject::connect(this, SIGNAL(clickTokenFetchError(QString)),
                      this, SLOT(handleClickTokenFetchError(QString)),
                      Qt::UniqueConnection);
-    fetchClickToken(downloadUrl);
+    fetchClickToken(downloadUrl, download_sha512);
 }
 
 void click::DownloadManager::handleClickTokenFetched(const QString& clickToken)
@@ -149,8 +149,8 @@
     headers[CLICK_TOKEN_HEADER()] = clickToken;
 
     udm::DownloadStruct downloadStruct(impl->downloadUrl,
-                                       DOWNLOAD_MANAGER_DO_NOT_HASH,
-                                       DOWNLOAD_MANAGER_IGNORE_HASH_ALGORITHM,
+                                       impl->download_sha512,
+                                       DOWNLOAD_MANAGER_SHA512,
                                        metadata,
                                        headers);
 
@@ -175,9 +175,10 @@
     }
 }
 
-void click::DownloadManager::fetchClickToken(const QString& downloadUrl)
+void click::DownloadManager::fetchClickToken(const QString& downloadUrl, const QString& download_sha512)
 {
     impl->downloadUrl = downloadUrl;
+    impl->download_sha512 = download_sha512;
     impl->updateCredentialsFromService();
 }
 
@@ -323,10 +324,10 @@
 };
 }
 
-void click::Downloader::startDownload(std::string url, std::string package_name,
+void click::Downloader::startDownload(const std::string& url, const std::string& download_sha512, const std::string& package_name,
                                       const std::function<void (std::pair<std::string, click::InstallError >)>& callback)
 {
-    qt::core::world::enter_with_task([this, callback, url, package_name] ()
+    qt::core::world::enter_with_task([this, callback, url, download_sha512, package_name] ()
     {
         auto& dm = downloadManagerInstance(networkAccessManager);
 
@@ -342,7 +343,7 @@
         QObject::connect(&dm, &click::DownloadManager::downloadError,
                          cb, &Callback::onDownloadError);
 
-        dm.startDownload(QString::fromStdString(url),
+        dm.startDownload(QString::fromStdString(url), QString::fromStdString(download_sha512),
                           QString::fromStdString(package_name));
     });
 }
 
=== modified file 'libclickscope/click/download-manager.h'
--- libclickscope/click/download-manager.h	2014-06-19 21:22:53 +0000
+++ libclickscope/click/download-manager.h	2014-08-13 14:49:17 +0000
@@ -66,8 +66,8 @@
     virtual ~DownloadManager();
 
 public slots:
-    virtual void startDownload(const QString& downloadUrl, const QString& package_name);
-    virtual void fetchClickToken(const QString& downloadUrl);
+    virtual void startDownload(const QString& downloadUrl, const QString& download_sha512, const QString& package_name);
+    virtual void fetchClickToken(const QString& downloadUrl, const QString& download_sha512);
 
 signals:
 
@@ -98,7 +98,7 @@
 public:
     Downloader(const QSharedPointer<click::network::AccessManager>& networkAccessManager);
     void get_download_progress(std::string package_name, const std::function<void (std::string)>& callback);
-    void startDownload(std::string url, std::string package_name,
+    void startDownload(const std::string& url, const std::string& download_sha512, const std::string& package_name,
                        const std::function<void (std::pair<std::string, InstallError>)>& callback);
 private:
     QSharedPointer<click::network::AccessManager> networkAccessManager;
 
=== modified file 'libclickscope/click/package.cpp'
--- libclickscope/click/package.cpp	2014-08-05 19:00:03 +0000
+++ libclickscope/click/package.cpp	2014-08-13 14:49:17 +0000
@@ -52,6 +52,7 @@
     return lhs.package == rhs.package &&
             lhs.description == rhs.description &&
             lhs.download_url == rhs.download_url &&
+            lhs.download_sha512 == rhs.download_sha512 &&
             lhs.rating == rhs.rating &&
             // TODO: keywords should be a list of strings
             lhs.keywords == rhs.keywords &&
@@ -144,6 +145,9 @@
         }
 
         // Optional details go here.
+        if (root[JsonKeys::download_sha512].isString())
+            details.download_sha512 = root[JsonKeys::download_sha512].asString();
+
         if (root[JsonKeys::version].isString())
             details.version = root[JsonKeys::version].asString();
 
@@ -245,6 +249,7 @@
         << print_string_if_not_empty(details.package.icon_url) << ", "
         << print_string_if_not_empty(details.description) << ", "
         << print_string_if_not_empty(details.download_url) << ", "
+        << print_string_if_not_empty(details.download_sha512) << ", "
         << details.rating << ", "
         << print_string_if_not_empty(details.keywords) << ", "
         << print_string_if_not_empty(details.terms_of_service) << ", "
 
=== modified file 'libclickscope/click/package.h'
--- libclickscope/click/package.h	2014-08-05 22:30:30 +0000
+++ libclickscope/click/package.h	2014-08-13 14:49:17 +0000
@@ -126,6 +126,7 @@
         constexpr static const char* icon_url{"icon_url"};
         constexpr static const char* description{"description"};
         constexpr static const char* download_url{"download_url"};
+        constexpr static const char* download_sha512{"download_sha512"};
         constexpr static const char* rating{"rating"};
         constexpr static const char* keywords{"keywords"};
 
@@ -155,6 +156,7 @@
 
     std::string description;
     std::string download_url;
+    std::string download_sha512;
     double rating;
     std::string keywords;
 
 
=== modified file 'libclickscope/click/preview.cpp'
--- libclickscope/click/preview.cpp	2014-07-25 20:25:49 +0000
+++ libclickscope/click/preview.cpp	2014-08-13 14:49:17 +0000
@@ -95,16 +95,34 @@
 // Preview base class
 
 Preview::Preview(const unity::scopes::Result& result,
-                 const unity::scopes::ActionMetadata& metadata,
-                 const QSharedPointer<click::web::Client>& client,
-                 const QSharedPointer<click::network::AccessManager>& nam,
-                 std::shared_ptr<click::DepartmentsDb> depts)
-    : PreviewQueryBase(result, metadata)
-{
-    strategy.reset(choose_strategy(result, metadata, client, nam, depts));
-}
-
-PreviewStrategy* Preview::choose_strategy(const unity::scopes::Result &result,
+                 const unity::scopes::ActionMetadata& metadata)
+    : PreviewQueryBase(result, metadata), result(result), metadata(metadata)
+{
+}
+
+Preview::~Preview()
+{
+}
+
+void Preview::choose_strategy(const QSharedPointer<web::Client> &client,
+                              const QSharedPointer<click::network::AccessManager>& nam,
+                              std::shared_ptr<click::DepartmentsDb> depts)
+{
+    strategy.reset(build_strategy(result, metadata, client, nam, depts));
+}
+
+PreviewStrategy* Preview::build_installing(const std::string& download_url,
+                                           const std::string& download_sha512,
+                                           const unity::scopes::Result& result,
+                                           const QSharedPointer<click::web::Client>& client,
+                                           const QSharedPointer<click::network::AccessManager>& nam,
+                                           std::shared_ptr<click::DepartmentsDb> depts)
+{
+    return new InstallingPreview(download_url, download_sha512, result, client, nam, depts);
+}
+
+
+PreviewStrategy* Preview::build_strategy(const unity::scopes::Result &result,
                                           const unity::scopes::ActionMetadata &metadata,
                                           const QSharedPointer<web::Client> &client,
                                           const QSharedPointer<click::network::AccessManager>& nam,
@@ -126,8 +144,9 @@
         } else if (metadict.count("action_id") != 0  && metadict.count("download_url") != 0) {
             std::string action_id = metadict["action_id"].get_string();
             std::string download_url = metadict["download_url"].get_string();
+            std::string download_sha512 = metadict["download_sha512"].get_string();
             if (action_id == click::Preview::Actions::INSTALL_CLICK) {
-                return new InstallingPreview(download_url, result, client, nam, depts);
+                return build_installing(download_url, download_sha512, result, client, nam, depts);
             } else {
                 qWarning() << "unexpected action id " << QString::fromStdString(action_id)
                            << " given with download_url" << QString::fromStdString(download_url);
@@ -447,12 +466,14 @@
 // class InstallingPreview
 
 InstallingPreview::InstallingPreview(const std::string &download_url,
+                                     const std::string &download_sha512,
                                      const unity::scopes::Result &result,
                                      const QSharedPointer<click::web::Client>& client,
                                      const QSharedPointer<click::network::AccessManager> &nam,
                                      std::shared_ptr<click::DepartmentsDb> depts)
     : PreviewStrategy(result, client), DepartmentUpdater(depts),
       download_url(download_url),
+      download_sha512(download_sha512),
       downloader(new click::Downloader(nam)),
       depts_db(depts)
 {
@@ -473,7 +494,8 @@
 
 void InstallingPreview::run(const unity::scopes::PreviewReplyProxy &reply)
 {
-    downloader->startDownload(download_url, result["name"].get_string(),
+    qDebug() << "Starting installation" << QString(download_url.c_str()) << QString(download_sha512.c_str());
+    downloader->startDownload(download_url, download_sha512, result["name"].get_string(),
             [this, reply] (std::pair<std::string, click::InstallError> rc){
               // NOTE: details not needed by fooErrorWidgets, so no need to populateDetails():
               switch (rc.second)
@@ -832,6 +854,7 @@
         tuple["price"] = scopes::Variant(details.package.price);
         tuple["store_item_id"] = details.package.name;
         tuple["download_url"] = details.download_url;
+        tuple["download_sha512"] = details.download_sha512;
         payments.add_attribute_value("source", scopes::Variant(tuple));
         widgets.push_back(payments);
     } else {
@@ -841,7 +864,8 @@
             {
                 {"id", scopes::Variant(click::Preview::Actions::INSTALL_CLICK)},
                 {"label", scopes::Variant(_("Install"))},
-                {"download_url", scopes::Variant(details.download_url)}
+                {"download_url", scopes::Variant(details.download_url)},
+                {"download_sha512", scopes::Variant(details.download_sha512)},
             });
         buttons.add_attribute_value("actions", builder.end());
         widgets.push_back(buttons);
 
=== modified file 'libclickscope/click/preview.h'
--- libclickscope/click/preview.h	2014-07-24 04:25:22 +0000
+++ libclickscope/click/preview.h	2014-08-13 14:49:17 +0000
@@ -42,6 +42,7 @@
 #include <unity/scopes/PreviewWidget.h>
 #include <unity/scopes/Result.h>
 #include <unity/scopes/ScopeBase.h>
+#include <unity/util/DefinesPtrs.h>
 
 namespace scopes = unity::scopes;
 
@@ -67,12 +68,21 @@
 {
 protected:
     std::unique_ptr<PreviewStrategy> strategy;
-    PreviewStrategy* choose_strategy(const unity::scopes::Result& result,
-                                     const unity::scopes::ActionMetadata& metadata,
-                                     const QSharedPointer<web::Client> &client,
-                                     const QSharedPointer<click::network::AccessManager>& nam,
-                                     std::shared_ptr<click::DepartmentsDb> depts);
+    const unity::scopes::Result& result;
+    const unity::scopes::ActionMetadata& metadata;
+    PreviewStrategy* build_strategy(const unity::scopes::Result& result,
+                                    const unity::scopes::ActionMetadata& metadata,
+                                    const QSharedPointer<web::Client> &client,
+                                    const QSharedPointer<click::network::AccessManager>& nam,
+                                    std::shared_ptr<click::DepartmentsDb> depts);
+    virtual PreviewStrategy* build_installing(const std::string& download_url,
+                                              const std::string& download_sha512,
+                                              const unity::scopes::Result& result,
+                                              const QSharedPointer<click::web::Client>& client,
+                                              const QSharedPointer<click::network::AccessManager>& nam,
+                                              std::shared_ptr<click::DepartmentsDb> depts);
 public:
+    UNITY_DEFINES_PTRS(Preview);
     struct Actions
     {
         Actions() = delete;
@@ -94,10 +104,11 @@
 
     Preview(const unity::scopes::Result& result);
     Preview(const unity::scopes::Result& result,
-            const unity::scopes::ActionMetadata& metadata,
-            const QSharedPointer<click::web::Client>& client,
-            const QSharedPointer<click::network::AccessManager>& nam,
-            std::shared_ptr<click::DepartmentsDb> depts);
+            const unity::scopes::ActionMetadata& metadata);
+    virtual ~Preview();
+    void choose_strategy(const QSharedPointer<web::Client> &client,
+                         const QSharedPointer<click::network::AccessManager>& nam,
+                         std::shared_ptr<click::DepartmentsDb> depts);
     // From unity::scopes::PreviewQuery
     void cancelled() override;
     virtual void run(unity::scopes::PreviewReplyProxy const& reply) override;
@@ -163,7 +174,8 @@
 {
 public:
     InstallingPreview(const unity::scopes::Result& result) : PreviewStrategy(result) {}
-    InstallingPreview(std::string const& download_url,
+    InstallingPreview(const std::string& download_url,
+                      const std::string& download_sha512,
                       const unity::scopes::Result& result,
                       const QSharedPointer<click::web::Client>& client,
                       const QSharedPointer<click::network::AccessManager>& nam,
@@ -176,6 +188,7 @@
 protected:
     virtual scopes::PreviewWidgetList progressBarWidget(const std::string& object_path);
     std::string download_url;
+    std::string download_sha512;
     QSharedPointer<click::Downloader> downloader;
     std::shared_ptr<click::DepartmentsDb> depts_db;
     void startLauncherAnimation(const PackageDetails& details);
 
=== modified file 'libclickscope/tests/fake_json.cpp'
--- libclickscope/tests/fake_json.cpp	2014-08-05 19:00:03 +0000
+++ libclickscope/tests/fake_json.cpp	2014-08-13 14:49:17 +0000
@@ -194,6 +194,7 @@
         "title": "\u1F4A9 Weather",
         "description": "\u1F4A9 Weather\nA weather application.",
         "download_url": "https://public.apps.staging.ubuntu.com/download/ar.com.beuno/wheather-touch/ar.com.beuno.wheather-touch-0.2",
+        "download_sha512": "fake_sha512",
         "rating": 3.5,
         "keywords": "these, are, key, words",
 
 
=== modified file 'libclickscope/tests/test_download_manager.cpp'
--- libclickscope/tests/test_download_manager.cpp	2014-06-19 21:22:53 +0000
+++ libclickscope/tests/test_download_manager.cpp	2014-08-13 14:49:17 +0000
@@ -58,6 +58,7 @@
 namespace
 {
 const QString TEST_URL("http://test.local/");
+const QString TEST_SHA512("fake_hash");
 const QString TEST_HEADER_VALUE("test header value");
 const QString TEST_APP_ID("test_app_id");
 const QString TEST_CLICK_TOKEN_VALUE("test token value");
@@ -326,7 +327,7 @@
     QTimer timer;
     timer.setSingleShot(true);
     QObject::connect(&timer, &QTimer::timeout, [&dm]() {
-            dm.fetchClickToken(TEST_URL);
+            dm.fetchClickToken(TEST_URL, TEST_SHA512);
         } );
     timer.start(0);
 
@@ -466,7 +467,7 @@
     QTimer timer;
     timer.setSingleShot(true);
     QObject::connect(&timer, &QTimer::timeout, [&dm]() {
-            dm.startDownload(TEST_URL, TEST_APP_ID);
+            dm.startDownload(TEST_URL, TEST_SHA512, TEST_APP_ID);
         } );
     timer.start(0);
 
 
=== modified file 'libclickscope/tests/test_index.cpp'
--- libclickscope/tests/test_index.cpp	2014-08-05 19:00:03 +0000
+++ libclickscope/tests/test_index.cpp	2014-08-13 14:49:17 +0000
@@ -342,6 +342,7 @@
         },
         "\u1F4A9 Weather\nA weather application.",
         "https://public.apps.staging.ubuntu.com/download/ar.com.beuno/wheather-touch/ar.com.beuno.wheather-touch-0.2",
+        "fake_sha512",
         3.5,
         "these, are, key, words",
 
@@ -407,6 +408,7 @@
         },
         (std::string("\u1F4A9 ") + std::string(appname_utf8.constData()) + "\nA weather application.").c_str(),
         "https://public.apps.staging.ubuntu.com/download/ar.com.beuno/wheather-touch/ar.com.beuno.wheather-touch-0.2",
+        "fake_sha512",
         3.5,
         "these, are, key, words",
 
 
=== modified file 'libclickscope/tests/test_preview.cpp'
--- libclickscope/tests/test_preview.cpp	2014-07-24 04:25:22 +0000
+++ libclickscope/tests/test_preview.cpp	2014-08-13 14:49:17 +0000
@@ -28,6 +28,7 @@
  */
 
 #include <unity/scopes/testing/MockPreviewReply.h>
+#include <unity/scopes/testing/Result.h>
 
 #include <gtest/gtest.h>
 #include <click/preview.h>
@@ -171,3 +172,41 @@
     std::vector<std::string> expected_order {"header", "screenshots"};
     ASSERT_EQ(expected_order, preview.call_order);
 }
+
+class StrategyChooserTest : public Test {
+protected:
+    unity::scopes::testing::Result result;
+    unity::scopes::ActionMetadata metadata;
+    unity::scopes::VariantMap metadict;
+    QSharedPointer<click::web::Client> client;
+    QSharedPointer<click::network::AccessManager> nam;
+    std::shared_ptr<click::DepartmentsDb> depts;
+    const std::string FAKE_SHA512 = "FAKE_SHA512";
+
+public:
+    StrategyChooserTest() : metadata("en_EN", "phone") {
+    }
+};
+
+class MockablePreview : public click::Preview {
+public:
+    MockablePreview(const unity::scopes::Result& result, const unity::scopes::ActionMetadata& metadata) :
+        click::Preview(result, metadata)
+    {
+
+    }
+
+    MOCK_METHOD6(build_installing, click::PreviewStrategy*(const std::string&, const std::string&,
+                const unity::scopes::Result&, const QSharedPointer<click::web::Client>&,
+                const QSharedPointer<click::network::AccessManager>&, std::shared_ptr<click::DepartmentsDb>));
+};
+
+TEST_F(StrategyChooserTest, testSha512IsUsed) {
+    metadict["action_id"] = click::Preview::Actions::INSTALL_CLICK;
+    metadict["download_url"] = "fake_download_url";
+    metadict["download_sha512"] = FAKE_SHA512;
+    metadata.set_scope_data(unity::scopes::Variant(metadict));
+    MockablePreview preview(result, metadata);
+    EXPECT_CALL(preview, build_installing(_, FAKE_SHA512, _, _, _, _));
+    preview.choose_strategy(client, nam, depts);
+}
 
=== modified file 'scope/clickapps/apps-query.h'
--- scope/clickapps/apps-query.h	2014-07-22 13:17:28 +0000
+++ scope/clickapps/apps-query.h	2014-08-13 14:49:17 +0000
@@ -61,7 +61,6 @@
         constexpr static const char* DESCRIPTION{"description"};
         constexpr static const char* MAIN_SCREENSHOT{"main_screenshot"};
         constexpr static const char* INSTALLED{"installed"};
-        constexpr static const char* DOWNLOAD_URL{"download_url"};
         constexpr static const char* VERSION{"version"};
     };
 
 
=== modified file 'scope/clickapps/apps-scope.cpp'
--- scope/clickapps/apps-scope.cpp	2014-08-06 21:48:26 +0000
+++ scope/clickapps/apps-scope.cpp	2014-08-13 14:49:17 +0000
@@ -98,7 +98,9 @@
 unity::scopes::PreviewQueryBase::UPtr click::Scope::preview(const unity::scopes::Result& result,
         const unity::scopes::ActionMetadata& metadata) {
     qDebug() << "Scope::preview() called.";
-    return scopes::PreviewQueryBase::UPtr{new click::Preview(result, metadata, client, nam, depts_db)};
+    auto preview = new click::Preview(result, metadata);
+    preview->choose_strategy(client, nam, depts_db);
+    return unity::scopes::PreviewQueryBase::UPtr{preview};
 }
 
 
 
=== modified file 'scope/clickstore/store-query.h'
--- scope/clickstore/store-query.h	2014-07-16 21:49:11 +0000
+++ scope/clickstore/store-query.h	2014-08-13 14:49:17 +0000
@@ -65,7 +65,6 @@
         constexpr static const char* MAIN_SCREENSHOT{"main_screenshot"};
         constexpr static const char* INSTALLED{"installed"};
         constexpr static const char* PURCHASED{"purchased"};
-        constexpr static const char* DOWNLOAD_URL{"download_url"};
         constexpr static const char* VERSION{"version"};
     };
 
 
=== modified file 'scope/clickstore/store-scope.cpp'
--- scope/clickstore/store-scope.cpp	2014-08-01 15:04:19 +0000
+++ scope/clickstore/store-scope.cpp	2014-08-13 14:49:17 +0000
@@ -102,7 +102,9 @@
 unity::scopes::PreviewQueryBase::UPtr click::Scope::preview(const unity::scopes::Result& result,
         const unity::scopes::ActionMetadata& metadata) {
     qDebug() << "Scope::preview() called.";
-    return scopes::PreviewQueryBase::UPtr{new click::Preview(result, metadata, client, nam, depts_db)};
+    auto preview = new click::Preview(result, metadata);
+    preview->choose_strategy(client, nam, depts_db);
+    return unity::scopes::PreviewQueryBase::UPtr{preview};
 }
 
 unity::scopes::ActivationQueryBase::UPtr click::Scope::perform_action(unity::scopes::Result const& result, unity::scopes::ActionMetadata const& metadata,
@@ -119,6 +121,8 @@
         std::string download_url = metadata.scope_data().get_dict()["download_url"].get_string();
         qDebug() << "the download url is: " << QString::fromStdString(download_url);
         activation->setHint("download_url", unity::scopes::Variant(download_url));
+        std::string download_sha512 = metadata.scope_data().get_dict()["download_sha512"].get_string();
+        activation->setHint("download_sha512", unity::scopes::Variant(download_sha512));
         activation->setHint("action_id", unity::scopes::Variant(click::Preview::Actions::INSTALL_CLICK));
         qDebug() << "returning ShowPreview";
         activation->setStatus(unity::scopes::ActivationResponse::Status::ShowPreview);
@@ -130,6 +134,8 @@
         std::string download_url = metadata.scope_data().get_dict()["download_url"].get_string();
         qDebug() << "the download url is: " << QString::fromStdString(download_url);
         activation->setHint("download_url", unity::scopes::Variant(download_url));
+        std::string download_sha512 = metadata.scope_data().get_dict()["download_sha512"].get_string();
+        activation->setHint("download_sha512", unity::scopes::Variant(download_sha512));
         activation->setHint("action_id", unity::scopes::Variant(action_id));
         qDebug() << "returning ShowPreview";
         activation->setStatus(unity::scopes::ActivationResponse::Status::ShowPreview);
 
=== modified file 'scope/tests/CMakeLists.txt'
--- scope/tests/CMakeLists.txt	2014-07-22 17:15:14 +0000
+++ scope/tests/CMakeLists.txt	2014-08-13 14:49:17 +0000
@@ -20,6 +20,7 @@
 add_executable (${CLICKSCOPE_TESTS_TARGET}
   test_pay.cpp
   test_query.cpp
+  test_store_scope.cpp
 )
 
 add_executable (${APPS_SCOPE_TESTS_TARGET}
 
=== modified file 'scope/tests/download_manager_tool/download_manager_tool.cpp'
--- scope/tests/download_manager_tool/download_manager_tool.cpp	2014-02-19 22:35:42 +0000
+++ scope/tests/download_manager_tool/download_manager_tool.cpp	2014-08-13 14:49:17 +0000
@@ -54,22 +54,22 @@
     emit finished();
 }
 
-void DownloadManagerTool::fetchClickToken(QString url)
+void DownloadManagerTool::fetchClickToken(QString url, QString sha512)
 {
     QObject::connect(_dm, &click::DownloadManager::clickTokenFetched,
                      this, &DownloadManagerTool::handleResponse);
     QObject::connect(_dm, &click::DownloadManager::clickTokenFetchError,
                      this, &DownloadManagerTool::handleResponse);
-    _dm->fetchClickToken(url);
+    _dm->fetchClickToken(url, sha512);
 }
 
-void DownloadManagerTool::startDownload(QString url, QString appId)
+void DownloadManagerTool::startDownload(QString url, QString sha512, QString appId)
 {
     QObject::connect(_dm, &click::DownloadManager::downloadStarted,
                      this, &DownloadManagerTool::handleResponse);
     QObject::connect(_dm, &click::DownloadManager::downloadError,
                      this, &DownloadManagerTool::handleResponse);
-    _dm->startDownload(url, appId);
+    _dm->startDownload(url, sha512, appId);
 }
 
 int main(int argc, char *argv[])
@@ -83,16 +83,16 @@
 
     QObject::connect(&tool, SIGNAL(finished()), &a, SLOT(quit()));
 
-    if (argc == 2) {
+    if (argc == 3) {
 
         QObject::connect(&timer, &QTimer::timeout, [&]() {
-                tool.fetchClickToken(QString(argv[1]));
+                tool.fetchClickToken(QString(argv[1]), QString(argv[2]));
             } );
 
-    } else if (argc == 3) {
+    } else if (argc == 4) {
 
         QObject::connect(&timer, &QTimer::timeout, [&]() {
-                downloader.startDownload(std::string(argv[1]), std::string(argv[2]),
+                downloader.startDownload(std::string(argv[1]), std::string(argv[2]), std::string(argv[3]),
                                          [&a] (std::pair<std::string, click::InstallError> arg){
                                              auto error = arg.second;
                                              if (error == click::InstallError::NoError) {
@@ -107,9 +107,9 @@
         
     } else {
         QTextStream(stderr) << "Usages:\n"
-                            << "download_manager_tool https://public.apps.ubuntu.com/download/<<rest of click package dl url>>\n" 
+                            << "download_manager_tool https://public.apps.ubuntu.com/download/<<rest of click package dl url>> sha512\n"
                             << "\t - when run with a valid U1 credential in the system, should print the click token to stdout.\n"
-                            << "download_manager_tool url app_id\n"
+                            << "download_manager_tool url sha512 app_id\n"
                             << "\t - with a valid credential, should begin a download.\n";
         
         return 1;
 
=== modified file 'scope/tests/download_manager_tool/download_manager_tool.h'
--- scope/tests/download_manager_tool/download_manager_tool.h	2014-02-11 09:47:54 +0000
+++ scope/tests/download_manager_tool/download_manager_tool.h	2014-08-13 14:49:17 +0000
@@ -40,8 +40,8 @@
     explicit DownloadManagerTool(QObject *parent=0);
                                                              
 public slots:
-    void fetchClickToken(QString url);
-    void startDownload(QString url, QString appId);
+    void fetchClickToken(QString url, QString sha512);
+    void startDownload(QString url, QString sha512, QString appId);
 
 private slots:
     void handleResponse(QString response);
 
=== added file 'scope/tests/test_store_scope.cpp'
--- scope/tests/test_store_scope.cpp	1970-01-01 00:00:00 +0000
+++ scope/tests/test_store_scope.cpp	2014-08-13 14:49:17 +0000
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2014 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 3, as published
+ * by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranties of
+ * MERCHANTABILITY, SATISFACTORY QUALITY, or FITNESS FOR A PARTICULAR
+ * PURPOSE.  See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * In addition, as a special exception, the copyright holders give
+ * permission to link the code of portions of this program with the
+ * OpenSSL library under certain conditions as described in each
+ * individual source file, and distribute linked combinations
+ * including the two.
+ * You must obey the GNU General Public License in all respects
+ * for all of the code used other than OpenSSL.  If you modify
+ * file(s) with this exception, you may extend this exception to your
+ * version of the file(s), but you are not obligated to do so.  If you
+ * do not wish to do so, delete this exception statement from your
+ * version.  If you delete this exception statement from all source
+ * files in the program, then also delete it here.
+ */
+
+#include <gtest/gtest.h>
+#include <gmock/gmock.h>
+
+#include <unity/scopes/testing/Result.h>
+
+#include <click/preview.h>
+#include <clickstore/store-scope.h>
+
+using namespace ::testing;
+
+class StoreScopeTest : public Test {
+protected:
+    const std::string FAKE_SHA512 = "FAKE_SHA512";
+    click::Scope scope;
+    unity::scopes::testing::Result result;
+    unity::scopes::ActionMetadata metadata;
+    unity::scopes::VariantMap metadict;
+
+public:
+    StoreScopeTest() : metadata("en_EN", "phone") {
+        metadict["download_url"] = "fake_download_url";
+        metadict["download_sha512"] = FAKE_SHA512;
+        metadata.set_scope_data(unity::scopes::Variant(metadict));
+    }
+};
+
+TEST_F(StoreScopeTest, testPurchaseCompletedPassesHash)
+{
+    auto activation = scope.perform_action(result, metadata, "widget_id", "purchaseCompleted");
+    auto response = activation->activate();
+    EXPECT_EQ(FAKE_SHA512, response.scope_data().get_dict()["download_sha512"].get_string());
+}
+
+TEST_F(StoreScopeTest, testInstallClickPassesHash)
+{
+    auto activation = scope.perform_action(result, metadata, "widget_id", click::Preview::Actions::INSTALL_CLICK);
+    auto response = activation->activate();
+    EXPECT_EQ(FAKE_SHA512, response.scope_data().get_dict()["download_sha512"].get_string());
+}