Download checksums.txt and verify the archive integrity. Every non-zero * result is a fail-closed refusal; verification is never optional. */
| 7110 | /* Download checksums.txt and verify the archive integrity. Every non-zero |
| 7111 | * result is a fail-closed refusal; verification is never optional. */ |
| 7112 | static int verify_download_checksum(const char *archive_path, const char *archive_name) { |
| 7113 | char checksum_file[CLI_BUF_256]; |
| 7114 | int checksum_path_length = |
| 7115 | snprintf(checksum_file, sizeof(checksum_file), "%s/cbm-checksums-XXXXXX", cbm_tmpdir()); |
| 7116 | if (checksum_path_length <= 0 || (size_t)checksum_path_length >= sizeof(checksum_file)) { |
| 7117 | return CLI_ERR; |
| 7118 | } |
| 7119 | int checksum_descriptor = cbm_mkstemp(checksum_file); |
| 7120 | if (checksum_descriptor < 0) { |
| 7121 | return CLI_ERR; |
| 7122 | } |
| 7123 | #ifdef _WIN32 |
| 7124 | int checksum_close_status = _close(checksum_descriptor); |
| 7125 | #else |
| 7126 | int checksum_close_status = close(checksum_descriptor); |
| 7127 | #endif |
| 7128 | if (checksum_close_status != 0) { |
| 7129 | cbm_unlink(checksum_file); |
| 7130 | return CLI_ERR; |
| 7131 | } |
| 7132 | |
| 7133 | char dl_base_buf[CLI_BUF_512]; |
| 7134 | const char *dl_base = |
| 7135 | cbm_safe_getenv("CBM_DOWNLOAD_URL", dl_base_buf, sizeof(dl_base_buf), NULL); |
| 7136 | char checksum_url[CLI_BUF_512]; |
| 7137 | int checksum_url_length; |
| 7138 | if (dl_base && dl_base[0]) { |
| 7139 | checksum_url_length = |
| 7140 | snprintf(checksum_url, sizeof(checksum_url), "%s/checksums.txt", dl_base); |
| 7141 | } else { |
| 7142 | checksum_url_length = |
| 7143 | snprintf(checksum_url, sizeof(checksum_url), "%s", |
| 7144 | "https://github.com/DeusData/codebase-memory-mcp/releases/latest/" |
| 7145 | "download/checksums.txt"); |
| 7146 | } |
| 7147 | if (checksum_url_length <= 0 || (size_t)checksum_url_length >= sizeof(checksum_url)) { |
| 7148 | cbm_unlink(checksum_file); |
| 7149 | return CLI_ERR; |
| 7150 | } |
| 7151 | int rc = cbm_download_to_file_quiet(checksum_url, checksum_file); |
| 7152 | if (rc != 0) { |
| 7153 | (void)fprintf(stderr, "error: could not download checksums.txt for mandatory " |
| 7154 | "verification\n"); |
| 7155 | cbm_unlink(checksum_file); |
| 7156 | return CLI_ERR; |
| 7157 | } |
| 7158 | |
| 7159 | char expected[SHA256_BUF_SIZE] = {0}; |
| 7160 | int manifest_status = |
| 7161 | cbm_cli_checksum_manifest_digest(checksum_file, archive_name, expected, sizeof(expected)); |
| 7162 | cbm_unlink(checksum_file); |
| 7163 | if (manifest_status != CLI_OK) { |
| 7164 | (void)fprintf(stderr, |
| 7165 | "error: checksums.txt has no single valid SHA-256 entry " |
| 7166 | "for exact artifact %s\n", |
| 7167 | archive_name); |
| 7168 | return CLI_ERR; |
| 7169 | } |
no test coverage detected