Download checksums.txt and verify the archive integrity. Every non-zero * result is a fail-closed refusal; verification is never optional. */
| 6961 | /* Download checksums.txt and verify the archive integrity. Every non-zero |
| 6962 | * result is a fail-closed refusal; verification is never optional. */ |
| 6963 | static int verify_download_checksum(const char *archive_path, const char *archive_name) { |
| 6964 | char checksum_file[CLI_BUF_256]; |
| 6965 | int checksum_path_length = |
| 6966 | snprintf(checksum_file, sizeof(checksum_file), "%s/cbm-checksums-XXXXXX", cbm_tmpdir()); |
| 6967 | if (checksum_path_length <= 0 || (size_t)checksum_path_length >= sizeof(checksum_file)) { |
| 6968 | return CLI_ERR; |
| 6969 | } |
| 6970 | int checksum_descriptor = cbm_mkstemp(checksum_file); |
| 6971 | if (checksum_descriptor < 0) { |
| 6972 | return CLI_ERR; |
| 6973 | } |
| 6974 | #ifdef _WIN32 |
| 6975 | int checksum_close_status = _close(checksum_descriptor); |
| 6976 | #else |
| 6977 | int checksum_close_status = close(checksum_descriptor); |
| 6978 | #endif |
| 6979 | if (checksum_close_status != 0) { |
| 6980 | cbm_unlink(checksum_file); |
| 6981 | return CLI_ERR; |
| 6982 | } |
| 6983 | |
| 6984 | char dl_base_buf[CLI_BUF_512]; |
| 6985 | const char *dl_base = |
| 6986 | cbm_safe_getenv("CBM_DOWNLOAD_URL", dl_base_buf, sizeof(dl_base_buf), NULL); |
| 6987 | char checksum_url[CLI_BUF_512]; |
| 6988 | int checksum_url_length; |
| 6989 | if (dl_base && dl_base[0]) { |
| 6990 | checksum_url_length = |
| 6991 | snprintf(checksum_url, sizeof(checksum_url), "%s/checksums.txt", dl_base); |
| 6992 | } else { |
| 6993 | checksum_url_length = |
| 6994 | snprintf(checksum_url, sizeof(checksum_url), "%s", |
| 6995 | "https://github.com/DeusData/codebase-memory-mcp/releases/latest/" |
| 6996 | "download/checksums.txt"); |
| 6997 | } |
| 6998 | if (checksum_url_length <= 0 || (size_t)checksum_url_length >= sizeof(checksum_url)) { |
| 6999 | cbm_unlink(checksum_file); |
| 7000 | return CLI_ERR; |
| 7001 | } |
| 7002 | int rc = cbm_download_to_file_quiet(checksum_url, checksum_file); |
| 7003 | if (rc != 0) { |
| 7004 | (void)fprintf(stderr, "error: could not download checksums.txt for mandatory " |
| 7005 | "verification\n"); |
| 7006 | cbm_unlink(checksum_file); |
| 7007 | return CLI_ERR; |
| 7008 | } |
| 7009 | |
| 7010 | char expected[SHA256_BUF_SIZE] = {0}; |
| 7011 | int manifest_status = |
| 7012 | cbm_cli_checksum_manifest_digest(checksum_file, archive_name, expected, sizeof(expected)); |
| 7013 | cbm_unlink(checksum_file); |
| 7014 | if (manifest_status != CLI_OK) { |
| 7015 | (void)fprintf(stderr, |
| 7016 | "error: checksums.txt has no single valid SHA-256 entry " |
| 7017 | "for exact artifact %s\n", |
| 7018 | archive_name); |
| 7019 | return CLI_ERR; |
| 7020 | } |
no test coverage detected