tstest/integration/vms: aggressively re-verify shasums (#2050)

I've run into a couple issues where the tests time out while a VM image
is being downloaded, making the cache poisoned for the next run. This
moves the hash checking into its own function and calls it much sooner
in the testing chain. If the hash check fails, the OS is redownloaded.

Signed-off-by: Christine Dodrill <xe@tailscale.com>

tstest/integration/vms/vms_test.go

@@ -10,6 +10,7 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -94,6 +95,19 @@ func fetchDistro(t *testing.T, resultDistro Distro) {
 	qcowPath := filepath.Join(cdir, "qcow2", resultDistro.sha256sum)
 
 	_, err = os.Stat(qcowPath)
+	if err == nil {
+		hash := checkCachedImageHash(t, resultDistro, cdir)
+		if hash != resultDistro.sha256sum {
+			t.Logf("hash for %s (%s) doesn't match expected %s, re-downloading", resultDistro.name, qcowPath, resultDistro.sha256sum)
+		}
+
+		if err := os.Remove(qcowPath); err != nil {
+			t.Fatalf("can't delete wrong cached image: %v", err)
+		}
+
+		err = errors.New("some fake non-nil error to force a redownload")
+	}
+
 	if err != nil {
 		t.Logf("downloading distro image %s to %s", resultDistro.url, qcowPath)
 		fout, err := os.Create(qcowPath)
@@ -121,6 +135,19 @@ func fetchDistro(t *testing.T, resultDistro Distro) {
 			t.Fatalf("can't close fout: %v", err)
 		}
 
+		hash := checkCachedImageHash(t, resultDistro, cdir)
+
+		if hash != resultDistro.sha256sum {
+			t.Fatalf("hash mismatch, want: %s, got: %s", resultDistro.sha256sum, hash)
+		}
+	}
+}
+
+func checkCachedImageHash(t *testing.T, d Distro, cacheDir string) (gotHash string) {
+	t.Helper()
+
+	qcowPath := filepath.Join(cacheDir, "qcow2", d.sha256sum)
+
 	fin, err := os.Open(qcowPath)
 	if err != nil {
 		t.Fatal(err)
@@ -130,16 +157,9 @@ func fetchDistro(t *testing.T, resultDistro Distro) {
 	if _, err := io.Copy(hasher, fin); err != nil {
 		t.Fatal(err)
 	}
-		hash := hex.EncodeToString(hasher.Sum(nil))
+	gotHash = hex.EncodeToString(hasher.Sum(nil))
 
-		if hash != resultDistro.sha256sum {
+	return
-			t.Logf("got:  %q", hash)
-			t.Logf("want: %q", resultDistro.sha256sum)
-			t.Fatal("hash mismatch, someone is doing something nasty")
-		}
-
-		t.Logf("hash check passed (%s)", resultDistro.sha256sum)
-	}
 }
 
 // run runs a command or fails the test.