Function verifyChecksum

internal/update/update.go:269–308

verifyChecksum downloads the expected SHA256 checksum and verifies the file.

(filePath, checksumURL string)

// verifyChecksum downloads the expected SHA256 checksum and verifies the file.
func verifyChecksum(filePath, checksumURL string) error {
	// Download checksum file
	client := &http.Client{Timeout: checkTimeout}
	resp, err := client.Get(checksumURL)
	if err != nil {
		return fmt.Errorf("downloading checksum: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return fmt.Errorf("checksum download returned status %d", resp.StatusCode)
	}

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return fmt.Errorf("reading checksum: %w", err)
	}

	// Parse checksum (format: "hash  filename" or just "hash")
	expectedHash := strings.Fields(strings.TrimSpace(string(body)))[0]

	// Calculate actual hash
	f, err := os.Open(filePath)
	if err != nil {
		return fmt.Errorf("opening file for checksum: %w", err)
	}
	defer f.Close()

	h := sha256.New()
	if _, err := io.Copy(h, f); err != nil {
		return fmt.Errorf("computing checksum: %w", err)
	}
	actualHash := hex.EncodeToString(h.Sum(nil))

	if actualHash != expectedHash {
		return fmt.Errorf("expected %s, got %s", expectedHash, actualHash)
	}

	return nil
}