Function verify_download_checksum

src/cli/cli.c:6919–6993

Download checksums.txt and verify the archive integrity. Every non-zero * result is a fail-closed refusal; verification is never optional. */

/* Download checksums.txt and verify the archive integrity. Every non-zero
 * result is a fail-closed refusal; verification is never optional. */
static int verify_download_checksum(const char *archive_path, const char *archive_name) {
    char checksum_file[CLI_BUF_256];
    int checksum_path_length =
        snprintf(checksum_file, sizeof(checksum_file), "%s/cbm-checksums-XXXXXX", cbm_tmpdir());
    if (checksum_path_length <= 0 || (size_t)checksum_path_length >= sizeof(checksum_file)) {
        return CLI_ERR;
    }
    int checksum_descriptor = cbm_mkstemp(checksum_file);
    if (checksum_descriptor < 0) {
        return CLI_ERR;
    }
#ifdef _WIN32
    int checksum_close_status = _close(checksum_descriptor);
#else
    int checksum_close_status = close(checksum_descriptor);
#endif
    if (checksum_close_status != 0) {
        cbm_unlink(checksum_file);
        return CLI_ERR;
    }

    char dl_base_buf[CLI_BUF_512];
    const char *dl_base =
        cbm_safe_getenv("CBM_DOWNLOAD_URL", dl_base_buf, sizeof(dl_base_buf), NULL);
    char checksum_url[CLI_BUF_512];
    int checksum_url_length;
    if (dl_base && dl_base[0]) {
        checksum_url_length =
            snprintf(checksum_url, sizeof(checksum_url), "%s/checksums.txt", dl_base);
    } else {
        checksum_url_length =
            snprintf(checksum_url, sizeof(checksum_url), "%s",
                     "https://github.com/DeusData/codebase-memory-mcp/releases/latest/"
                     "download/checksums.txt");
    }
    if (checksum_url_length <= 0 || (size_t)checksum_url_length >= sizeof(checksum_url)) {
        cbm_unlink(checksum_file);
        return CLI_ERR;
    }
    int rc = cbm_download_to_file_quiet(checksum_url, checksum_file);
    if (rc != 0) {
        (void)fprintf(stderr, "error: could not download checksums.txt for mandatory "
                              "verification\n");
        cbm_unlink(checksum_file);
        return CLI_ERR;
    }

    char expected[SHA256_BUF_SIZE] = {0};
    int manifest_status =
        cbm_cli_checksum_manifest_digest(checksum_file, archive_name, expected, sizeof(expected));
    cbm_unlink(checksum_file);
    if (manifest_status != CLI_OK) {
        (void)fprintf(stderr,
                      "error: checksums.txt has no single valid SHA-256 entry "
                      "for exact artifact %s\n",
                      archive_name);
        return CLI_ERR;
    }