Download checksums.txt and verify the archive integrity. Every non-zero * result is a fail-closed refusal; verification is never optional. */
| 7274 | /* Download checksums.txt and verify the archive integrity. Every non-zero |
| 7275 | * result is a fail-closed refusal; verification is never optional. */ |
| 7276 | static int verify_download_checksum(const char *archive_path, const char *archive_name) { |
| 7277 | char checksum_file[CLI_BUF_256]; |
| 7278 | int checksum_path_length = |
| 7279 | snprintf(checksum_file, sizeof(checksum_file), "%s/cbm-checksums-XXXXXX", cbm_tmpdir()); |
| 7280 | if (checksum_path_length <= 0 || (size_t)checksum_path_length >= sizeof(checksum_file)) { |
| 7281 | return CLI_ERR; |
| 7282 | } |
| 7283 | int checksum_descriptor = cbm_mkstemp(checksum_file); |
| 7284 | if (checksum_descriptor < 0) { |
| 7285 | return CLI_ERR; |
| 7286 | } |
| 7287 | #ifdef _WIN32 |
| 7288 | int checksum_close_status = _close(checksum_descriptor); |
| 7289 | #else |
| 7290 | int checksum_close_status = close(checksum_descriptor); |
| 7291 | #endif |
| 7292 | if (checksum_close_status != 0) { |
| 7293 | cbm_unlink(checksum_file); |
| 7294 | return CLI_ERR; |
| 7295 | } |
| 7296 | |
| 7297 | char dl_base_buf[CLI_BUF_512]; |
| 7298 | const char *dl_base = |
| 7299 | cbm_safe_getenv("CBM_DOWNLOAD_URL", dl_base_buf, sizeof(dl_base_buf), NULL); |
| 7300 | char checksum_url[CLI_BUF_512]; |
| 7301 | int checksum_url_length; |
| 7302 | if (dl_base && dl_base[0]) { |
| 7303 | checksum_url_length = |
| 7304 | snprintf(checksum_url, sizeof(checksum_url), "%s/checksums.txt", dl_base); |
| 7305 | } else { |
| 7306 | checksum_url_length = |
| 7307 | snprintf(checksum_url, sizeof(checksum_url), "%s", |
| 7308 | "https://github.com/DeusData/codebase-memory-mcp/releases/latest/" |
| 7309 | "download/checksums.txt"); |
| 7310 | } |
| 7311 | if (checksum_url_length <= 0 || (size_t)checksum_url_length >= sizeof(checksum_url)) { |
| 7312 | cbm_unlink(checksum_file); |
| 7313 | return CLI_ERR; |
| 7314 | } |
| 7315 | int rc = cbm_download_to_file_quiet(checksum_url, checksum_file); |
| 7316 | if (rc != 0) { |
| 7317 | (void)fprintf(stderr, "error: could not download checksums.txt for mandatory " |
| 7318 | "verification\n"); |
| 7319 | cbm_unlink(checksum_file); |
| 7320 | return CLI_ERR; |
| 7321 | } |
| 7322 | |
| 7323 | char expected[SHA256_BUF_SIZE] = {0}; |
| 7324 | int manifest_status = |
| 7325 | cbm_cli_checksum_manifest_digest(checksum_file, archive_name, expected, sizeof(expected)); |
| 7326 | cbm_unlink(checksum_file); |
| 7327 | if (manifest_status != CLI_OK) { |
| 7328 | (void)fprintf(stderr, |
| 7329 | "error: checksums.txt has no single valid SHA-256 entry " |
| 7330 | "for exact artifact %s\n", |
| 7331 | archive_name); |
| 7332 | return CLI_ERR; |
| 7333 | } |
no test coverage detected