Function verify_download_checksum

src/cli/cli.c:3068–3129

Download checksums.txt and verify the archive integrity. * Returns: 0 = verified OK, 1 = mismatch (FAIL), -1 = could not verify (warning). */

/* Download checksums.txt and verify the archive integrity.
 * Returns: 0 = verified OK, 1 = mismatch (FAIL), -1 = could not verify (warning). */
static int verify_download_checksum(const char *archive_path, const char *archive_name) {
    char checksum_file[CLI_BUF_256];
    snprintf(checksum_file, sizeof(checksum_file), "%s/cbm-checksums.txt", cbm_tmpdir());

    char dl_base_buf[CLI_BUF_512];
    const char *dl_base =
        cbm_safe_getenv("CBM_DOWNLOAD_URL", dl_base_buf, sizeof(dl_base_buf), NULL);
    char checksum_url[CLI_BUF_512];
    if (dl_base && dl_base[0]) {
        snprintf(checksum_url, sizeof(checksum_url), "%s/checksums.txt", dl_base);
    } else {
        snprintf(checksum_url, sizeof(checksum_url), "%s",
                 "https://github.com/DeusData/codebase-memory-mcp/releases/latest/download/"
                 "checksums.txt");
    }
    int rc = cbm_download_to_file_quiet(checksum_url, checksum_file);
    if (rc != 0) {
        (void)fprintf(stderr,
                      "warning: could not download checksums.txt — skipping verification\n");
        cbm_unlink(checksum_file);
        return CLI_ERR;
    }

    FILE *fp = fopen(checksum_file, "r");
    cbm_unlink(checksum_file);
    if (!fp) {
        return CLI_ERR;
    }

    char expected[SHA256_BUF_SIZE] = {0};
    char line[CLI_BUF_512];
    while (fgets(line, sizeof(line), fp)) {
        /* Format: <CBM_SZ_64-char sha256>  <filename>\n */
        if (strlen(line) > CHECKSUM_LINE_MIN && strstr(line, archive_name)) {
            memcpy(expected, line, SHA256_HEX_LEN);
            expected[SHA256_HEX_LEN] = '\0';
            break;
        }
    }
    (void)fclose(fp);

    if (expected[0] == '\0') {
        (void)fprintf(stderr, "warning: %s not found in checksums.txt\n", archive_name);
        return CLI_ERR;
    }

    char actual[SHA256_BUF_SIZE] = {0};
    if (cbm_cli_sha256_file(archive_path, actual, sizeof(actual)) != 0) {
        (void)fprintf(stderr, "error: could not compute checksum (sha256 tool unavailable)\n");
        return CLI_ERR;
    }

    if (strcmp(expected, actual) != 0) {
        (void)fprintf(stderr, "error: CHECKSUM MISMATCH — downloaded binary may be compromised!\n");
        (void)fprintf(stderr, "  expected: %s\n", expected);
        (void)fprintf(stderr, "  actual:   %s\n", actual);
        return CLI_TRUE;
    }