Add a downloader + verifier for static.rust-lang.org

[emberian]

This is pretty primitive and completely synchronous with no progress notifications.

First step towards #172

[vosen]

I'm not a security person by any stretch of the imagination, so this might be dumb, but what does checking for exact cert fingerprint gives us?

[emberian]

It gives us the knowledge that the connection isn't being MITM'd by any other certificates that may be trusted by the root CA store - either added by malware, compromised certificate, or just plain malice (which has been documented)

[emberian]

It's called certificate pinning, and browsers use it in the form of HSTS.

[vosen]

I don't enforce any particular style of coding in this project, but please use camelCase for variables and function arguments.
i don't know which gpg4win build did you download, but in "vanilla" package, gpg2.exe and gpgconf.exe don't depend on libassuan-0.dll, giving a modest of saving of 69KB.
And a heads up, I'll merge this after releasing 0.1.1 into the wild, which will happen once I get my identity verified for code signing certificate, so this PR might linger here few days longer than seemingly necessary.

[emberian]

@vosen No problem! I'm glad we'll be getting a signing cert :) I'll clean up the style - C# isn't what I've used in any projects except minor "learn the language" programs. I'll poke around for something that doesn't depend on libassuan-0.dll

[emberian]

I'm back to uni tomorrow so I might be a bit slower than usual in responding, as well.

[emberian]

Also, as detailed a review as you can give in regards to structure etc is useful for me - I don't do much programming in the OO style, and C# is a language I'm very weak in. Any avoidance of useful features or handy library things is not a guided choice, but just ignorance!

[vosen]

Your style is OK, other than using a Gpg singleton. I know, we have some examples of this style in the codebase already, but it should be avoided. And I've noticed just now that the VS settings in ReinitializeGpgPaths are only read once, at the first use of Gpg. This is wrong, we won't apply any settings updates.

[Boddlnagg]

I guess this is outdated and we should just wrap rustup instead, right? (Sorry for the wasted effort ...)