Implement hash validation on packages for file integrity check / incremental download / re-use download

[mikehardy]

The system should be able to pull a checksum from the version.json and verify the signature matches prior to applying the update

[mikehardy]

This should be possible in a backwards-compatible way. "As of 2012 best practice recommendation is to use SHA-2" (which implies SHA256 as the most popular implementation of that family of file integrity hash

https://en.wikipedia.org/wiki/File_verification#File_formats

[mikehardy]

When this is done, it should also be possible to do incremental downloads, and to see if an existing file already present in the cache directory matches the intended download

[mikehardy]

I am currently working on an app that uses this library, and I generate a JSON like this - with correct sha256 -anticipating support for the extra elements here soon:

{
  "versionName": "1.0.1-pre2085.staging",
  "apkUrl": "https://my.awesome.app.com/MyAwesomeApp-latest-staging.apk",
  "versionCode": "12085",
  "size": 26155737,
  "sha256": "168c6f480f9f94345490ed246041a35c3acf09872a606b5a00936d47d49ac9d5",
  "forceUpdate": false
}

Could possibly add the checksum for the signing cert as well, as signing cert clashes are a hard fail on install

Errors in validation should be reported with onError hook (#14) with messages prefixed as 'errorXXX' (e.g., 'errorInvalidChecksum', 'errorCertMismatch' etc)