Download checksums.txt and verify the archive integrity. Every non-zero * result is a fail-closed refusal; verification is never optional. */
| 7946 | /* Download checksums.txt and verify the archive integrity. Every non-zero |
| 7947 | * result is a fail-closed refusal; verification is never optional. */ |
| 7948 | static int verify_download_checksum(const char *archive_path, const char *archive_name) { |
| 7949 | char checksum_file[CLI_BUF_256]; |
| 7950 | int checksum_path_length = |
| 7951 | snprintf(checksum_file, sizeof(checksum_file), "%s/cbm-checksums-XXXXXX", cbm_tmpdir()); |
| 7952 | if (checksum_path_length <= 0 || (size_t)checksum_path_length >= sizeof(checksum_file)) { |
| 7953 | return CLI_ERR; |
| 7954 | } |
| 7955 | int checksum_descriptor = cbm_mkstemp(checksum_file); |
| 7956 | if (checksum_descriptor < 0) { |
| 7957 | return CLI_ERR; |
| 7958 | } |
| 7959 | #ifdef _WIN32 |
| 7960 | int checksum_close_status = _close(checksum_descriptor); |
| 7961 | #else |
| 7962 | int checksum_close_status = close(checksum_descriptor); |
| 7963 | #endif |
| 7964 | if (checksum_close_status != 0) { |
| 7965 | cbm_unlink(checksum_file); |
| 7966 | return CLI_ERR; |
| 7967 | } |
| 7968 | |
| 7969 | char dl_base_buf[CLI_BUF_512]; |
| 7970 | const char *dl_base = |
| 7971 | cbm_safe_getenv("CBM_DOWNLOAD_URL", dl_base_buf, sizeof(dl_base_buf), NULL); |
| 7972 | char checksum_url[CLI_BUF_512]; |
| 7973 | int checksum_url_length; |
| 7974 | if (dl_base && dl_base[0]) { |
| 7975 | checksum_url_length = |
| 7976 | snprintf(checksum_url, sizeof(checksum_url), "%s/checksums.txt", dl_base); |
| 7977 | } else { |
| 7978 | checksum_url_length = |
| 7979 | snprintf(checksum_url, sizeof(checksum_url), "%s", |
| 7980 | "https://github.com/DeusData/codebase-memory-mcp/releases/latest/" |
| 7981 | "download/checksums.txt"); |
| 7982 | } |
| 7983 | if (checksum_url_length <= 0 || (size_t)checksum_url_length >= sizeof(checksum_url)) { |
| 7984 | cbm_unlink(checksum_file); |
| 7985 | return CLI_ERR; |
| 7986 | } |
| 7987 | int rc = cbm_download_to_file_quiet(checksum_url, checksum_file); |
| 7988 | if (rc != 0) { |
| 7989 | (void)fprintf(stderr, "error: could not download checksums.txt for mandatory " |
| 7990 | "verification\n"); |
| 7991 | cbm_unlink(checksum_file); |
| 7992 | return CLI_ERR; |
| 7993 | } |
| 7994 | |
| 7995 | char expected[SHA256_BUF_SIZE] = {0}; |
| 7996 | int manifest_status = |
| 7997 | cbm_cli_checksum_manifest_digest(checksum_file, archive_name, expected, sizeof(expected)); |
| 7998 | cbm_unlink(checksum_file); |
| 7999 | if (manifest_status != CLI_OK) { |
| 8000 | (void)fprintf(stderr, |
| 8001 | "error: checksums.txt has no single valid SHA-256 entry " |
| 8002 | "for exact artifact %s\n", |
| 8003 | archive_name); |
| 8004 | return CLI_ERR; |
| 8005 | } |
no test coverage detected