一个疑似 base64 编码的数据求解

[h404bi]

最近找到了可以获取 Microsoft Edge 的 Offline Installer （不需要管理员权限安装的 exe 包体，跟官网提供的 enterprise msi 包体不同）的一个 API：

curl -XPOST "https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/91.0.864.54/files?action=GenerateDownloadInfo&foregroundPriority=true" -d '{"targetingAttributes":{}}'

除了 Offline Installer 外，还有增量包体。应该是 MicrosoftEdgeUpdate 程序调用的 API，用来检查和下载更新。一个返回示例：

[{"FileId":"MicrosoftEdge_X64_91.0.864.54_91.0.864.41.exe","Url":"http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cfa50eb3-534c-46d0-a913-a39d579988b7?P1=1627558634&P2=404&P3=2&P4=HwucV0KjBP5sgCX2JFNT1DJwRmSPPyB6s1Uz1alehA9pHlFW%2bG9u1aD1nouRZDtTluLU1qtiwL2tYXfKmm4dfA%3d%3d","SizeInBytes":8344976,"Hashes":{"Sha1":"pYhI3UY0IAQf7ko9D4eAWuCbYJg=","Sha256":"5e2p9gmu8QMzfWNVXjvXbovZeDxmGHWIkdj1oVbMuk8="},"DeliveryOptimization":{"CatalogId":"5e2p9gmu8QMzfWNVXjvXbovZeDxmGHWIkdj1oVbMuk8=","Properties":{"IntegrityCheckInfo":{"PiecesHashFileUrl":"http://msedge.f.dl.delivery.mp.microsoft.com/filestreamingservice/files/cfa50eb3-534c-46d0-a913-a39d579988b7/pieceshash","HashOfHashes":"w7aWGGXHf/q+ZOy0qpPYy8v4+KPQJbR9WgH6CPRHVuo="}}}},{"FileId":"MicrosoftEdge_X64_91.0.864.54_91.0.864.48.exe","Url":"http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8fe8e0e7-8dec-4df5-96f7-9b645ef693b9?P1=1627558634&P2=404&P3=2&P4=SCEjcYBbLe01zj1N0b9JkhWfOKDSPp5r1VnFEi%2fev2otedtbrAofCNkx8LO3J7Hqld0nCtWk1vUqnB8vwIhkpg%3d%3d","SizeInBytes":7988112,"Hashes":{"Sha1":"bwUU0Xz8PaR2BCa8MjEWRPNFE6o=","Sha256":"7vLwiCEPFLvTGGpj6FaaWJDoCMxpFt170EoAaLP/ew8="},"DeliveryOptimization":{"CatalogId":"7vLwiCEPFLvTGGpj6FaaWJDoCMxpFt170EoAaLP_ew8=","Properties":{"IntegrityCheckInfo":{"PiecesHashFileUrl":"http://msedge.f.dl.delivery.mp.microsoft.com/filestreamingservice/files/8fe8e0e7-8dec-4df5-96f7-9b645ef693b9/pieceshash","HashOfHashes":"c+b0U3LKT+S6jDJqEykw7sNSaQVHu5d1FVwohBFC9Nc="}}}},{"FileId":"MicrosoftEdge_X64_91.0.864.54_91.0.864.53.exe","Url":"http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f3a0195-f9c4-4804-b75c-d61909420e5d?P1=1627558634&P2=404&P3=2&P4=fxiOAn1XkVuEqJHS1LrXu89onmEJplV%2fOT9XBRB6QXDxTUXIc0nEmuODTku7d%2bOZiFq1Mw0g%2bizmh%2bpvnzoyJQ%3d%3d","SizeInBytes":5313424,"Hashes":{"Sha1":"554gbMA+Mt8P9tH/WrspG79Y1Bg=","Sha256":"0Ar2PCKE4DAHwuLCJMBZwdQfbyNPwfATtJjzwUD6Qqk="},"DeliveryOptimization":{"CatalogId":"0Ar2PCKE4DAHwuLCJMBZwdQfbyNPwfATtJjzwUD6Qqk=","Properties":{"IntegrityCheckInfo":{"PiecesHashFileUrl":"http://msedge.f.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f3a0195-f9c4-4804-b75c-d61909420e5d/pieceshash","HashOfHashes":"wDktXJkxxo7nqsIr32QIC3fX5iVOchaGrj7FIVumQhE="}}}},{"FileId":"MicrosoftEdge_X64_91.0.864.54.exe","Url":"http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8ea0c2f4-26f9-408f-a75d-8d9bcbe1d7e8?P1=1627558634&P2=404&P3=2&P4=OXQZgotFC672T4jLkEsKlF5jui%2fPt1LJyCI64ifymJS2m1cW%2bWYUY0xurPSFT3MMWacKmtsWp2BwCBUritWBbg%3d%3d","SizeInBytes":102998928,"Hashes":{"Sha1":"cX7CNgxfQpSMDpxv5EHjxZoMdAc=","Sha256":"8kzuS/mKg8LlHd0yD2DriJ0B4ZIEG4rCiFP17pxj0C0="},"DeliveryOptimization":{"CatalogId":"8kzuS_mKg8LlHd0yD2DriJ0B4ZIEG4rCiFP17pxj0C0=","Properties":{"IntegrityCheckInfo":{"PiecesHashFileUrl":"http://msedge.f.dl.delivery.mp.microsoft.com/filestreamingservice/files/8ea0c2f4-26f9-408f-a75d-8d9bcbe1d7e8/pieceshash","HashOfHashes":"nPZwsmRwknu0fXGN0UaVpCkIzqDAZf5O/VHsSPgNNCg="}}}}]

取其中一个展开：

{
  "FileId": "MicrosoftEdge_X64_91.0.864.54_91.0.864.53.exe",
  "Url": "http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f3a0195-f9c4-4804-b75c-d61909420e5d?P1=1627558634&P2=404&P3=2&P4=fxiOAn1XkVuEqJHS1LrXu89onmEJplV%2fOT9XBRB6QXDxTUXIc0nEmuODTku7d%2bOZiFq1Mw0g%2bizmh%2bpvnzoyJQ%3d%3d",
  "SizeInBytes": 5313424,
  "Hashes": {
    "Sha1": "554gbMA+Mt8P9tH/WrspG79Y1Bg=",
    "Sha256": "0Ar2PCKE4DAHwuLCJMBZwdQfbyNPwfATtJjzwUD6Qqk="
  },
  "DeliveryOptimization": {
    "CatalogId": "0Ar2PCKE4DAHwuLCJMBZwdQfbyNPwfATtJjzwUD6Qqk=",
    "Properties": {
      "IntegrityCheckInfo": {
        "PiecesHashFileUrl": "http://msedge.f.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f3a0195-f9c4-4804-b75c-d61909420e5d/pieceshash",
        "HashOfHashes": "wDktXJkxxo7nqsIr32QIC3fX5iVOchaGrj7FIVumQhE="
      }
    }
  }
}

接口返回有包体的下载 URL 和哈希。我想下载包体后做哈希校验，问题出现。Sha1 和 Sha256 这两个值看上去应该就是 base64，但 decode 出来后不是目标哈希值。有没有可能是其他类型的编码，求个思路。

[Jirajine]

你确定不是？一般哈希值都是 hex 编码完以后的，你得对比原始的二进制。

[ysc3839]

你该不会觉得常见 hash 算法的结果是纯文本的吧？结果是任意数据，只不过大部分时候使用 hex 编码了 (也可以说是 base16 或 16 进制编码)。为了节省空间，也可以使用 base64 编码。

[AoEiuV020]

这不显然就是哈希完直接 base64 出来的，解 base64 再 16 进制编码就有常用的格式了，
0Ar2PCKE4DAHwuLCJMBZwdQfbyNPwfATtJjzwUD6Qqk -> d00af63c2284e03007c2e2c224c059c1d41f6f234fc1f013b498f3c140fa42a9

[Vegetable]

hash 只是算法，常见用 hex 表示，但是也可以用 base64 。如果先 hex 再 base64...倒是也见过，不过这多余了。

[sutra]

"Sha1": "554gbMA+Mt8P9tH/WrspG79Y1Bg="

就是 Url 所指文件的内容的，sha1 摘要后的 base64 string：

byte[] fileContent;
byte[] sha1Bytes = sha1(fileContent);
String sha1Base64String = Base64.encodeToString(sha1Bytes);