Function cbm_cli_sha256_file

src/cli/cli.c:6707–6736

Compute the SHA-256 of a file in-process (no external hashing tool — those * differ per OS, may be absent, and mis-quote paths under cmd.exe). Writes a * 64-char hex digest + NUL to out. Returns 0 on success. Not static: * exercised directly by the self-update checksum regression test. */

 * 64-char hex digest + NUL to out. Returns 0 on success. Not static:
 * exercised directly by the self-update checksum regression test. */
int cbm_cli_sha256_file(const char *path, char *out, size_t out_size) {
    if (out_size < SHA256_BUF_SIZE) {
        return CLI_ERR;
    }
    FILE *fp = cbm_fopen(path, "rb");
    if (!fp) {
        return CLI_ERR;
    }
    cbm_sha256_ctx ctx;
    cbm_sha256_init(&ctx);
    unsigned char buf[CLI_BUF_1K];
    size_t n;
    while ((n = fread(buf, 1, sizeof(buf), fp)) > 0) {
        cbm_sha256_update(&ctx, buf, n);
    }
    int read_err = ferror(fp);
    fclose(fp);
    if (read_err) {
        return CLI_ERR;
    }
    uint8_t digest[CBM_SHA256_DIGEST_LEN];
    cbm_sha256_final(&ctx, digest);
    static const char hex[] = "0123456789abcdef";
    for (int i = 0; i < CBM_SHA256_DIGEST_LEN; i++) {
        out[i * 2] = hex[digest[i] >> 4];
        out[i * 2 + 1] = hex[digest[i] & 0x0f];
    }
    out[SHA256_HEX_LEN] = '\0';
    return 0;
}

static int cli_checksum_hex_nibble(unsigned char value) {
    if (value >= (unsigned char)'0' && value <= (unsigned char)'9') {