Function sha256_vector_ok

tests/test_cli.c:11930–11950

The self-update path verifies a downloaded archive against a published * checksum. That check is only meaningful if the digest is actually computed — * a broken hash command (it once invoked `shasum -a CBM_SZ_256`, an invalid * algorithm, from a bad macro rename inside the shell string) makes every * digest fail, and the caller then falls through and installs unverified. * Guard the digest it

/* Hash `content` (len bytes) via a temp file and compare to expected hex.
 * Returns 1 on match, 0 otherwise. */
static int sha256_vector_ok(const void *content, size_t len, const char *expected) {
    char path[512];
    snprintf(path, sizeof(path), "%s/cbm_sha_XXXXXX", cbm_tmpdir());
    int fd = cbm_mkstemp(path);
    if (fd < 0) {
        return 0;
    }
    FILE *fp = fdopen(fd, "wb");
    if (!fp) {
        return 0;
    }
    if (len > 0) {
        fwrite(content, 1, len, fp);
    }
    fclose(fp);

    char digest[128] = {0};
    int rc = cbm_cli_sha256_file(path, digest, sizeof(digest));
    remove(path);
    return rc == 0 && strcmp(digest, expected) == 0;
}

static bool cli_checksum_manifest_path(char *path, size_t path_size) {
    int written = snprintf(path, path_size, "%s/cbm-checksum-XXXXXX", cbm_tmpdir());