fix: checksum rustup in CI (#2501)

* fix: checksum rustup in CI

* chore: integrate feedback

Co-authored-by: Andrew Lamb <alamb@influxdata.com>

Co-authored-by: Andrew Lamb <alamb@influxdata.com>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

.circleci/config.yml

@@ -164,8 +164,8 @@ jobs:
       - checkout
 
       - run:
-          name: Install Rust
-          command: curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain none
+          name: Install rustup
+          command: scripts/install_rustup.sh
 
       - run:
           name: Install perf.py dependencies

scripts/install_rustup.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# Use rustup to install rust tool chain after first
+# comparing to a known checksum
+set -eu -o pipefail
+
+RUSTUP_VERSION=1.24.3
+RUSTUP_HASH=a3cb081f88a6789d104518b30d4aa410009cd08c3822a1226991d6cf0442a0f8
+
+# Notice --location to follow redirects -- important on Ubuntu 20.04
+curl --proto '=https' --tlsv1.2 -sSf --location --max-redirs 1 \
+  https://raw.githubusercontent.com/rust-lang/rustup/${RUSTUP_VERSION}/rustup-init.sh -O
+
+if [ -x "$(command -v shasum)" ]; then
+  hashcmd="shasum --algorithm 256"
+elif [ -x "$(command -v sha256sum)" ]; then
+  hashcmd="sha256sum"
+else
+  echo "no SHA hash command found"
+  exit 1
+fi
+
+# Notice two spaces between hash and filename -- important on Darwin
+echo "${RUSTUP_HASH}  rustup-init.sh" | ${hashcmd} --check -- \
+  || { echo "checksum error!"; exit 1; }
+
+sh rustup-init.sh -y --default-toolchain none