From 0247dc7b576eb72fcb13e99f0cdb3c2afba84532 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Tue, 11 Aug 2026 18:28:08 +0530 Subject: [PATCH 1/5] Add archive checksum verification for Vorpal and SCA Resolver installers Verifies the downloaded Vorpal/SCA Resolver archive against a sha256sum checksum file before extraction, and removes the archive if verification fails, to guard against tampered or corrupted downloads. --- .../asca/ascaconfig/asca-linux-amd.go | 14 ++- .../asca/ascaconfig/asca-linux-arm.go | 14 ++- .../commands/asca/ascaconfig/asca-mac-amd.go | 14 ++- .../commands/asca/ascaconfig/asca-mac-arm.go | 14 ++- .../commands/asca/ascaconfig/asca-windows.go | 14 ++- .../osinstaller/os-installer-structs.go | 37 ++++++ internal/services/osinstaller/os-installer.go | 116 +++++++++++++++++- 7 files changed, 192 insertions(+), 31 deletions(-) diff --git a/internal/commands/asca/ascaconfig/asca-linux-amd.go b/internal/commands/asca/ascaconfig/asca-linux-amd.go index babfe4881..78b7bfcbf 100644 --- a/internal/commands/asca/ascaconfig/asca-linux-amd.go +++ b/internal/commands/asca/ascaconfig/asca-linux-amd.go @@ -7,10 +7,12 @@ import ( ) var Params = osinstaller.InstallationConfiguration{ - ExecutableFile: "vorpal_linux_x64", - DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_linux_x64.tar.gz", - HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", - FileName: "vorpal.tar.gz", - HashFileName: "hash.txt", - WorkingDirName: "CxVorpal", + ExecutableFile: "vorpal_linux_x64", + DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_linux_x64.tar.gz", + HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", + FileName: "vorpal.tar.gz", + HashFileName: "hash.txt", + WorkingDirName: "CxVorpal", + ArchiveChecksumDownloadURL: "https://download.checkmarx.com/vorpal-binary/checksums.sha256", + ArchiveChecksumFileName: "checksums.sha256", } diff --git a/internal/commands/asca/ascaconfig/asca-linux-arm.go b/internal/commands/asca/ascaconfig/asca-linux-arm.go index 5763acb15..1825ff3ab 100644 --- a/internal/commands/asca/ascaconfig/asca-linux-arm.go +++ b/internal/commands/asca/ascaconfig/asca-linux-arm.go @@ -7,10 +7,12 @@ import ( ) var Params = osinstaller.InstallationConfiguration{ - ExecutableFile: "vorpal_linux_arm64", - DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_linux_arm64.tar.gz", - HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", - FileName: "vorpal.tar.gz", - HashFileName: "hash.txt", - WorkingDirName: "CxVorpal", + ExecutableFile: "vorpal_linux_arm64", + DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_linux_arm64.tar.gz", + HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", + FileName: "vorpal.tar.gz", + HashFileName: "hash.txt", + WorkingDirName: "CxVorpal", + ArchiveChecksumDownloadURL: "https://download.checkmarx.com/vorpal-binary/checksums.sha256", + ArchiveChecksumFileName: "checksums.sha256", } diff --git a/internal/commands/asca/ascaconfig/asca-mac-amd.go b/internal/commands/asca/ascaconfig/asca-mac-amd.go index 5a05c2100..8c67e93ba 100644 --- a/internal/commands/asca/ascaconfig/asca-mac-amd.go +++ b/internal/commands/asca/ascaconfig/asca-mac-amd.go @@ -7,10 +7,12 @@ import ( ) var Params = osinstaller.InstallationConfiguration{ - ExecutableFile: "vorpal_darwin_x64", - DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_darwin_x64.tar.gz", - HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", - FileName: "vorpal.tar.gz", - HashFileName: "hash.txt", - WorkingDirName: "CxVorpal", + ExecutableFile: "vorpal_darwin_x64", + DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_darwin_x64.tar.gz", + HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", + FileName: "vorpal.tar.gz", + HashFileName: "hash.txt", + WorkingDirName: "CxVorpal", + ArchiveChecksumDownloadURL: "https://download.checkmarx.com/vorpal-binary/checksums.sha256", + ArchiveChecksumFileName: "checksums.sha256", } diff --git a/internal/commands/asca/ascaconfig/asca-mac-arm.go b/internal/commands/asca/ascaconfig/asca-mac-arm.go index 49bfa7625..cd75418e5 100644 --- a/internal/commands/asca/ascaconfig/asca-mac-arm.go +++ b/internal/commands/asca/ascaconfig/asca-mac-arm.go @@ -7,10 +7,12 @@ import ( ) var Params = osinstaller.InstallationConfiguration{ - ExecutableFile: "vorpal_darwin_arm64", - DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_darwin_arm64.tar.gz", - HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", - FileName: "vorpal.tar.gz", - HashFileName: "hash.txt", - WorkingDirName: "CxVorpal", + ExecutableFile: "vorpal_darwin_arm64", + DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_darwin_arm64.tar.gz", + HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", + FileName: "vorpal.tar.gz", + HashFileName: "hash.txt", + WorkingDirName: "CxVorpal", + ArchiveChecksumDownloadURL: "https://download.checkmarx.com/vorpal-binary/checksums.sha256", + ArchiveChecksumFileName: "checksums.sha256", } diff --git a/internal/commands/asca/ascaconfig/asca-windows.go b/internal/commands/asca/ascaconfig/asca-windows.go index 43893e60e..f10021d71 100644 --- a/internal/commands/asca/ascaconfig/asca-windows.go +++ b/internal/commands/asca/ascaconfig/asca-windows.go @@ -7,10 +7,12 @@ import ( ) var Params = osinstaller.InstallationConfiguration{ - ExecutableFile: "vorpal_windows_x64.exe", - DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_windows_x64.zip", - HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", - FileName: "vorpal.zip", - HashFileName: "hash.txt", - WorkingDirName: "CxVorpal", + ExecutableFile: "vorpal_windows_x64.exe", + DownloadURL: "https://download.checkmarx.com/vorpal-binary/vorpal_windows_x64.zip", + HashDownloadURL: "https://download.checkmarx.com/vorpal-binary/hash.txt", + FileName: "vorpal.zip", + HashFileName: "hash.txt", + WorkingDirName: "CxVorpal", + ArchiveChecksumDownloadURL: "https://download.checkmarx.com/vorpal-binary/checksums.sha256", + ArchiveChecksumFileName: "checksums.sha256", } diff --git a/internal/services/osinstaller/os-installer-structs.go b/internal/services/osinstaller/os-installer-structs.go index 12f61cc52..1d2f75128 100644 --- a/internal/services/osinstaller/os-installer-structs.go +++ b/internal/services/osinstaller/os-installer-structs.go @@ -3,6 +3,9 @@ package osinstaller import ( "os" "path/filepath" + "strings" + + "github.com/pkg/errors" ) type InstallationConfiguration struct { @@ -12,6 +15,9 @@ type InstallationConfiguration struct { FileName string HashFileName string WorkingDirName string + // Vorpal: per-artifact checksum URL for binary verification + ArchiveChecksumDownloadURL string + ArchiveChecksumFileName string } func (i *InstallationConfiguration) ExecutableFilePath() string { @@ -40,3 +46,34 @@ func (i *InstallationConfiguration) WorkingDir() string { } return filepath.Join(basePath, i.WorkingDirName) } + +// BinaryFilePath returns the path to the downloaded archive on disk (before extraction). +func (i *InstallationConfiguration) BinaryFilePath() string { + return filepath.Join(i.WorkingDir(), i.FileName) +} + +// ArchiveChecksumFilePath is the local path for the optional per-artifact checksum file. +func (i *InstallationConfiguration) ArchiveChecksumFilePath() string { + if i.ArchiveChecksumFileName == "" { + return "" + } + return filepath.Join(i.WorkingDir(), i.ArchiveChecksumFileName) +} + +// resolveArchiveChecksumVerification returns the local sha256sum path and whether it still needs to be downloaded. +// Vorpal uses separate hash files for version checking (hash.txt) and binary verification (checksums.sha256); +// SCA Resolver uses .sha256sum for both purposes. +func (i *InstallationConfiguration) resolveArchiveChecksumVerification() (localPath string, needsExtraDownload bool, err error) { + if i.ArchiveChecksumDownloadURL != "" { + if i.ArchiveChecksumFileName == "" { + return "", false, errors.New("ArchiveChecksumFileName is required when ArchiveChecksumDownloadURL is set") + } + return i.ArchiveChecksumFilePath(), true, nil + } + + if strings.HasSuffix(i.HashFileName, ".sha256sum") { + return i.HashFilePath(), false, nil + } + + return "", false, nil +} diff --git a/internal/services/osinstaller/os-installer.go b/internal/services/osinstaller/os-installer.go index f686cbf9c..a869671e4 100644 --- a/internal/services/osinstaller/os-installer.go +++ b/internal/services/osinstaller/os-installer.go @@ -9,6 +9,7 @@ import ( "net/http" "os" "path/filepath" + "strings" "time" "github.com/checkmarx/ast-cli/internal/logger" @@ -73,16 +74,38 @@ func InstallOrUpgrade(installationConfiguration *InstallationConfiguration, asca return false, err } - // Download hash file + // Hash file serves different purposes: version check for Vorpal, both version check and verification for SCA err = downloadHashFile(installationConfiguration.HashDownloadURL, installationConfiguration.HashFilePath()) if err != nil { return false, err } + // Must shut down service before replacement to release file locks if ascaWrapper != nil { shutDownAndWait(ascaWrapper) } + checksumPath, needsArchiveChecksumDownload, err := installationConfiguration.resolveArchiveChecksumVerification() + if err != nil { + return false, err + } + if needsArchiveChecksumDownload { + err = downloadFile(installationConfiguration.ArchiveChecksumDownloadURL, checksumPath) + if err != nil { + return false, err + } + } + if checksumPath != "" { + err = verifyArchiveAgainstSHA256SumFile(installationConfiguration.BinaryFilePath(), checksumPath, installationConfiguration.DownloadURL) + if err != nil { + logger.PrintIfVerbose("Removing potentially compromised archive due to checksum verification failure") + _ = os.Remove(installationConfiguration.BinaryFilePath()) + return false, errors.Errorf("Archive integrity verification failed for %s: Checksum verification failed - archive may have been compromised", installationConfiguration.ExecutableFile) + } + } else { + logger.PrintIfVerbose("Skipping archive checksum verification (no sha256sum source configured for this installation)") + } + // Unzip or extract downloaded zip depending on which OS is running err = UnzipOrExtractFiles(installationConfiguration) if err != nil { @@ -197,3 +220,94 @@ func shutDownAndWait(ascaWrapper grpcs.AscaWrapper) { } logger.PrintIfVerbose("Timed out waiting for Vorpal service to stop; proceeding anyway.") } + +// verifyArchiveAgainstSHA256SumFile checks that archivePath matches the digest in a GNU sha256sum-style file. +// For Vorpal: searches using the platform-specific filename from downloadURL. +// Supports single-line format (one checksum) or multi-line format (searches for matching filename). +func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadURL string) error { + logger.PrintIfVerbose("Verifying downloaded archive against sha256sum checksum") + + content, err := os.ReadFile(sha256SumFilePath) + if err != nil { + return errors.Errorf("Failed to read checksum file: %s", err.Error()) + } + + fileContent := strings.TrimSpace(string(content)) + if fileContent == "" { + return errors.New("Checksum file is empty") + } + + // Extract the actual platform-specific filename from downloadURL + _, downloadFileName := filepath.Split(downloadURL) + logger.PrintIfVerbose("Searching checksum file for: " + downloadFileName) + expectedHash := "" + + // Try to find matching filename in checksums file + for _, line := range strings.Split(fileContent, "\n") { + line = strings.TrimSpace(line) + if line == "" { + continue + } + + fields := strings.Fields(line) + if len(fields) < 2 { + continue + } + + hash := strings.ToLower(fields[0]) + filename := fields[len(fields)-1] + + // Check if this line matches the download filename + if filename == downloadFileName { + logger.PrintIfVerbose("Found matching checksum entry for: " + filename) + expectedHash = hash + break + } + } + + // If no exact match found, fall back to first line (single-line format) + if expectedHash == "" { + fields := strings.Fields(fileContent) + if len(fields) < 1 { + return errors.New("Invalid checksum file format - no hash found") + } + expectedHash = strings.ToLower(fields[0]) + } + + if len(expectedHash) != 64 { + return errors.Errorf("Invalid hash length - expected 64 hex characters, got %d", len(expectedHash)) + } + + actualHash, err := calculateSHA256(archivePath) + if err != nil { + return errors.Errorf("Failed to calculate archive hash: %s", err.Error()) + } + + logger.PrintIfVerbose(fmt.Sprintf("Actual Hash in Checksum.txt: %s", expectedHash)) + logger.PrintIfVerbose(fmt.Sprintf("Actual Hash of Zip: %s", actualHash)) + + if !strings.EqualFold(expectedHash, actualHash) { + return errors.New("Checksum verification failed - archive may have been tampered with") + } + + logger.PrintIfVerbose("Archive Checksum Verification Successful.") + return nil +} + +// calculateSHA256 calculates the SHA256 hash of a file +func calculateSHA256(filePath string) (string, error) { + file, err := os.Open(filePath) + if err != nil { + return "", err + } + defer func() { + _ = file.Close() + }() + + hasher := sha256.New() + if _, err := io.Copy(hasher, file); err != nil { + return "", err + } + + return fmt.Sprintf("%x", hasher.Sum(nil)), nil +} From e0d3151dcdd7cf50ec623c0945756677d67446d8 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Tue, 11 Aug 2026 18:41:57 +0530 Subject: [PATCH 2/5] Fix lint: extract magic numbers and trim verbose comments golangci-lint (mnd) flagged the raw 2 and 64 literals in the sha256sum parsing logic; pull them into named constants and tighten two overly long comments. --- .../services/osinstaller/os-installer-structs.go | 4 +--- internal/services/osinstaller/os-installer.go | 14 +++++++++----- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/internal/services/osinstaller/os-installer-structs.go b/internal/services/osinstaller/os-installer-structs.go index 1d2f75128..ae4395d07 100644 --- a/internal/services/osinstaller/os-installer-structs.go +++ b/internal/services/osinstaller/os-installer-structs.go @@ -60,9 +60,7 @@ func (i *InstallationConfiguration) ArchiveChecksumFilePath() string { return filepath.Join(i.WorkingDir(), i.ArchiveChecksumFileName) } -// resolveArchiveChecksumVerification returns the local sha256sum path and whether it still needs to be downloaded. -// Vorpal uses separate hash files for version checking (hash.txt) and binary verification (checksums.sha256); -// SCA Resolver uses .sha256sum for both purposes. +// resolveArchiveChecksumVerification returns the local sha256sum path to verify against, and whether it must be downloaded first. func (i *InstallationConfiguration) resolveArchiveChecksumVerification() (localPath string, needsExtraDownload bool, err error) { if i.ArchiveChecksumDownloadURL != "" { if i.ArchiveChecksumFileName == "" { diff --git a/internal/services/osinstaller/os-installer.go b/internal/services/osinstaller/os-installer.go index a869671e4..928b79dd0 100644 --- a/internal/services/osinstaller/os-installer.go +++ b/internal/services/osinstaller/os-installer.go @@ -221,9 +221,13 @@ func shutDownAndWait(ascaWrapper grpcs.AscaWrapper) { logger.PrintIfVerbose("Timed out waiting for Vorpal service to stop; proceeding anyway.") } -// verifyArchiveAgainstSHA256SumFile checks that archivePath matches the digest in a GNU sha256sum-style file. -// For Vorpal: searches using the platform-specific filename from downloadURL. -// Supports single-line format (one checksum) or multi-line format (searches for matching filename). +const ( + sha256SumFileMinFields = 2 + sha256HexLength = 64 +) + +// verifyArchiveAgainstSHA256SumFile checks archivePath against its digest in a GNU sha256sum-style file, +// matching by downloadURL's filename, or falling back to a single-line checksum format. func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadURL string) error { logger.PrintIfVerbose("Verifying downloaded archive against sha256sum checksum") @@ -250,7 +254,7 @@ func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadU } fields := strings.Fields(line) - if len(fields) < 2 { + if len(fields) < sha256SumFileMinFields { continue } @@ -274,7 +278,7 @@ func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadU expectedHash = strings.ToLower(fields[0]) } - if len(expectedHash) != 64 { + if len(expectedHash) != sha256HexLength { return errors.Errorf("Invalid hash length - expected 64 hex characters, got %d", len(expectedHash)) } From 08c7da785dca8089dd3b2fac102e5595a944f575 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Wed, 12 Aug 2026 18:29:16 +0530 Subject: [PATCH 3/5] change error msg --- .../osinstaller/os-installer-structs.go | 2 +- internal/services/osinstaller/os-installer.go | 34 ++++++++----------- 2 files changed, 15 insertions(+), 21 deletions(-) diff --git a/internal/services/osinstaller/os-installer-structs.go b/internal/services/osinstaller/os-installer-structs.go index ae4395d07..38e18a335 100644 --- a/internal/services/osinstaller/os-installer-structs.go +++ b/internal/services/osinstaller/os-installer-structs.go @@ -73,5 +73,5 @@ func (i *InstallationConfiguration) resolveArchiveChecksumVerification() (localP return i.HashFilePath(), false, nil } - return "", false, nil + return "", false, errors.New("ChecksumFileName is required for sha verification.") } diff --git a/internal/services/osinstaller/os-installer.go b/internal/services/osinstaller/os-installer.go index 928b79dd0..22f9dcd5e 100644 --- a/internal/services/osinstaller/os-installer.go +++ b/internal/services/osinstaller/os-installer.go @@ -87,7 +87,8 @@ func InstallOrUpgrade(installationConfiguration *InstallationConfiguration, asca checksumPath, needsArchiveChecksumDownload, err := installationConfiguration.resolveArchiveChecksumVerification() if err != nil { - return false, err + _ = os.Remove(installationConfiguration.BinaryFilePath()) + return false, errors.Errorf("Checksum verification failed for %s - installation was not complete.", installationConfiguration.FileName) } if needsArchiveChecksumDownload { err = downloadFile(installationConfiguration.ArchiveChecksumDownloadURL, checksumPath) @@ -98,12 +99,12 @@ func InstallOrUpgrade(installationConfiguration *InstallationConfiguration, asca if checksumPath != "" { err = verifyArchiveAgainstSHA256SumFile(installationConfiguration.BinaryFilePath(), checksumPath, installationConfiguration.DownloadURL) if err != nil { - logger.PrintIfVerbose("Removing potentially compromised archive due to checksum verification failure") _ = os.Remove(installationConfiguration.BinaryFilePath()) - return false, errors.Errorf("Archive integrity verification failed for %s: Checksum verification failed - archive may have been compromised", installationConfiguration.ExecutableFile) + return false, errors.Errorf("Checksum verification failed for %s - installation was not complete.", installationConfiguration.FileName) } } else { - logger.PrintIfVerbose("Skipping archive checksum verification (no sha256sum source configured for this installation)") + _ = os.Remove(installationConfiguration.BinaryFilePath()) + return false, errors.Errorf("Checksum verification failed for %s - installation was not complete.", installationConfiguration.FileName) } // Unzip or extract downloaded zip depending on which OS is running @@ -222,28 +223,27 @@ func shutDownAndWait(ascaWrapper grpcs.AscaWrapper) { } const ( - sha256SumFileMinFields = 2 - sha256HexLength = 64 + sha256SumFileMinFields = 2 + sha256HexLength = 64 + ChecksumVerifcationFailed = "Checksum verification failed." ) // verifyArchiveAgainstSHA256SumFile checks archivePath against its digest in a GNU sha256sum-style file, // matching by downloadURL's filename, or falling back to a single-line checksum format. func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadURL string) error { - logger.PrintIfVerbose("Verifying downloaded archive against sha256sum checksum") content, err := os.ReadFile(sha256SumFilePath) if err != nil { - return errors.Errorf("Failed to read checksum file: %s", err.Error()) + return errors.Errorf(ChecksumVerifcationFailed) } fileContent := strings.TrimSpace(string(content)) if fileContent == "" { - return errors.New("Checksum file is empty") + return errors.New(ChecksumVerifcationFailed) } // Extract the actual platform-specific filename from downloadURL _, downloadFileName := filepath.Split(downloadURL) - logger.PrintIfVerbose("Searching checksum file for: " + downloadFileName) expectedHash := "" // Try to find matching filename in checksums file @@ -263,7 +263,6 @@ func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadU // Check if this line matches the download filename if filename == downloadFileName { - logger.PrintIfVerbose("Found matching checksum entry for: " + filename) expectedHash = hash break } @@ -273,28 +272,23 @@ func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadU if expectedHash == "" { fields := strings.Fields(fileContent) if len(fields) < 1 { - return errors.New("Invalid checksum file format - no hash found") + return errors.New(ChecksumVerifcationFailed) } expectedHash = strings.ToLower(fields[0]) } if len(expectedHash) != sha256HexLength { - return errors.Errorf("Invalid hash length - expected 64 hex characters, got %d", len(expectedHash)) + return errors.Errorf(ChecksumVerifcationFailed) } actualHash, err := calculateSHA256(archivePath) if err != nil { - return errors.Errorf("Failed to calculate archive hash: %s", err.Error()) + return errors.Errorf(ChecksumVerifcationFailed) } - logger.PrintIfVerbose(fmt.Sprintf("Actual Hash in Checksum.txt: %s", expectedHash)) - logger.PrintIfVerbose(fmt.Sprintf("Actual Hash of Zip: %s", actualHash)) - if !strings.EqualFold(expectedHash, actualHash) { - return errors.New("Checksum verification failed - archive may have been tampered with") + return errors.New(ChecksumVerifcationFailed) } - - logger.PrintIfVerbose("Archive Checksum Verification Successful.") return nil } From e2ba5a10eb493b9d0b3a2cdc52d63178d32b4c63 Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Wed, 12 Aug 2026 20:15:14 +0530 Subject: [PATCH 4/5] Fix lint: unexport checksum error constant and drop stray blank line golangci-lint flagged the exported ChecksumVerifcationFailed constant (revive) and a leading blank line in verifyArchiveAgainstSHA256SumFile (whitespace); unexport and fix the typo since it's only used within this file, and remove the blank line. --- internal/services/osinstaller/os-installer.go | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/internal/services/osinstaller/os-installer.go b/internal/services/osinstaller/os-installer.go index 22f9dcd5e..becd9a3f8 100644 --- a/internal/services/osinstaller/os-installer.go +++ b/internal/services/osinstaller/os-installer.go @@ -223,23 +223,22 @@ func shutDownAndWait(ascaWrapper grpcs.AscaWrapper) { } const ( - sha256SumFileMinFields = 2 - sha256HexLength = 64 - ChecksumVerifcationFailed = "Checksum verification failed." + sha256SumFileMinFields = 2 + sha256HexLength = 64 + checksumVerificationFailed = "Checksum verification failed." ) // verifyArchiveAgainstSHA256SumFile checks archivePath against its digest in a GNU sha256sum-style file, // matching by downloadURL's filename, or falling back to a single-line checksum format. func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadURL string) error { - content, err := os.ReadFile(sha256SumFilePath) if err != nil { - return errors.Errorf(ChecksumVerifcationFailed) + return errors.Errorf(checksumVerificationFailed) } fileContent := strings.TrimSpace(string(content)) if fileContent == "" { - return errors.New(ChecksumVerifcationFailed) + return errors.New(checksumVerificationFailed) } // Extract the actual platform-specific filename from downloadURL @@ -272,22 +271,22 @@ func verifyArchiveAgainstSHA256SumFile(archivePath, sha256SumFilePath, downloadU if expectedHash == "" { fields := strings.Fields(fileContent) if len(fields) < 1 { - return errors.New(ChecksumVerifcationFailed) + return errors.New(checksumVerificationFailed) } expectedHash = strings.ToLower(fields[0]) } if len(expectedHash) != sha256HexLength { - return errors.Errorf(ChecksumVerifcationFailed) + return errors.Errorf(checksumVerificationFailed) } actualHash, err := calculateSHA256(archivePath) if err != nil { - return errors.Errorf(ChecksumVerifcationFailed) + return errors.Errorf(checksumVerificationFailed) } if !strings.EqualFold(expectedHash, actualHash) { - return errors.New(ChecksumVerifcationFailed) + return errors.New(checksumVerificationFailed) } return nil } From 72f772e1a46cec69483aa483ac178a5dfe56820a Mon Sep 17 00:00:00 2001 From: Sumit Morchhale Date: Thu, 13 Aug 2026 17:41:42 +0530 Subject: [PATCH 5/5] change error msg --- internal/services/osinstaller/os-installer.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/services/osinstaller/os-installer.go b/internal/services/osinstaller/os-installer.go index becd9a3f8..0b136e801 100644 --- a/internal/services/osinstaller/os-installer.go +++ b/internal/services/osinstaller/os-installer.go @@ -88,7 +88,7 @@ func InstallOrUpgrade(installationConfiguration *InstallationConfiguration, asca checksumPath, needsArchiveChecksumDownload, err := installationConfiguration.resolveArchiveChecksumVerification() if err != nil { _ = os.Remove(installationConfiguration.BinaryFilePath()) - return false, errors.Errorf("Checksum verification failed for %s - installation was not complete.", installationConfiguration.FileName) + return false, errors.Errorf("Installation failed due to an invalid checksum for %s", installationConfiguration.FileName) } if needsArchiveChecksumDownload { err = downloadFile(installationConfiguration.ArchiveChecksumDownloadURL, checksumPath) @@ -100,11 +100,11 @@ func InstallOrUpgrade(installationConfiguration *InstallationConfiguration, asca err = verifyArchiveAgainstSHA256SumFile(installationConfiguration.BinaryFilePath(), checksumPath, installationConfiguration.DownloadURL) if err != nil { _ = os.Remove(installationConfiguration.BinaryFilePath()) - return false, errors.Errorf("Checksum verification failed for %s - installation was not complete.", installationConfiguration.FileName) + return false, errors.Errorf("Installation failed due to an invalid checksum for %s", installationConfiguration.FileName) } } else { _ = os.Remove(installationConfiguration.BinaryFilePath()) - return false, errors.Errorf("Checksum verification failed for %s - installation was not complete.", installationConfiguration.FileName) + return false, errors.Errorf("Installation failed due to an invalid checksum for %s", installationConfiguration.FileName) } // Unzip or extract downloaded zip depending on which OS is running