cmd/release: double-check gzip files are single streams

Updates golang/go#19052

Change-Id: I453dd1cc6016bf137f25f4e5b7a772b2c1888279
Reviewed-on: https://go-review.googlesource.com/36913
Reviewed-by: Joe Tsai <thebrokentoaster@gmail.com>

cmd/release/release.go

@@ -10,6 +10,7 @@ package main
 import (
 	"archive/tar"
 	"archive/zip"
+	"bufio"
 	"bytes"
 	"compress/gzip"
 	"context"
@@ -601,10 +602,39 @@ func (b *Build) writeFile(name string, r io.Reader) error {
 	if err := f.Close(); err != nil {
 		return err
 	}
+	if strings.HasSuffix(name, ".gz") {
+		if err := verifyGzipSingleStream(name); err != nil {
+			return fmt.Errorf("error verifying that %s is a single-stream gzip: %v", name, err)
+		}
+	}
 	b.logf("Wrote %q.", name)
 	return nil
 }
 
+// verifyGzipSingleStream verifies that the named gzip file is not
+// a multi-stream file. See golang.org/issue/19052
+func verifyGzipSingleStream(name string) error {
+	f, err := os.Open(name)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	br := bufio.NewReader(f)
+	zr, err := gzip.NewReader(br)
+	if err != nil {
+		return err
+	}
+	zr.Multistream(false)
+	if _, err := io.Copy(ioutil.Discard, zr); err != nil {
+		return fmt.Errorf("reading first stream: %v", err)
+	}
+	peek, err := br.Peek(1)
+	if len(peek) > 0 || err != io.EOF {
+		return fmt.Errorf("unexpected peek of %d, %v after first gzip stream", len(peek), err)
+	}
+	return nil
+}
+
 func addPrefix(prefix string, in []string) []string {
 	var out []string
 	for _, s := range in {