feat(download): implement checksum verification with --checksum flag #154

Merged

fuzzy merged 2 commits from feature/checksum-verification into main

2026-07-14 05:57:33 +00:00

automation commented

2026-07-14 05:53:02 +00:00

Owner

What

Add --checksum flag for post-download integrity verification. Supports SHA256 (64 hex chars) and MD5 (32 hex chars).

Why

Users need to verify downloaded files haven't been corrupted in transit, especially for critical ISOs and packages.

Implementation

internal/config/config.go — --checksum flag, PGET_CHECKSUM env override
internal/downloader/download.go — verifyChecksum() reads file, hashes with crypto/sha256 or crypto/md5, compares to expected value
Verification happens after pt.Done() but before the success return
On match: prints checksum verified (<hash>)
On mismatch: returns error with expected vs actual, cleans up output file

Testing

Manual: --checksum=0c15e883... passes on matching file
Manual: --checksum=0000... returns "checksum mismatch" error
Manual: 32-char hex uses MD5, 64-char uses SHA256, other lengths rejected
go build ./..., go vet ./..., golangci-lint run — all clean

Breaking Changes

None

Closes #90, #87, #88, #89

## What Add `--checksum` flag for post-download integrity verification. Supports SHA256 (64 hex chars) and MD5 (32 hex chars). ## Why Users need to verify downloaded files haven't been corrupted in transit, especially for critical ISOs and packages. ## Implementation - `internal/config/config.go` — `--checksum` flag, `PGET_CHECKSUM` env override - `internal/downloader/download.go` — `verifyChecksum()` reads file, hashes with `crypto/sha256` or `crypto/md5`, compares to expected value - Verification happens after `pt.Done()` but before the success return - On match: prints `checksum verified (<hash>)` - On mismatch: returns error with expected vs actual, cleans up output file ## Testing - [x] Manual: `--checksum=0c15e883...` passes on matching file - [x] Manual: `--checksum=0000...` returns "checksum mismatch" error - [x] Manual: 32-char hex uses MD5, 64-char uses SHA256, other lengths rejected - [x] `go build ./...`, `go vet ./...`, `golangci-lint run` — all clean ## Breaking Changes None Closes #90, #87, #88, #89

automation added 2 commits

2026-07-14 05:53:02 +00:00

feat(download): implement checksum verification with --checksum flag bba1f88ea1

Add --checksum flag supporting SHA256 (64 hex chars) and MD5 (32 hex
chars). After download completes, opens file and verifies hash. Reports
error on mismatch. Supports PGET_CHECKSUM env override.

Closes #90, #87, #88, #89

docs(roadmap): mark checksum verification complete

Test and Release / lint (pull_request) Successful in 2m48s

Details

Test and Release / test (pull_request) Successful in 4m27s

Details

27b8f1323e

Closes #90, #87, #88, #89

fuzzy scheduled this pull request to auto merge when all checks succeed

2026-07-14 05:53:14 +00:00

the.auditor approved these changes

2026-07-14 05:53:45 +00:00

the.auditor left a comment

Review: APPROVED

Verification

go vet ./... — ✅ passes
go build ./... — ✅ passes
golangci-lint v2 run ./... — ✅ 0 issues

Changes

internal/downloader/download.go — verifyChecksum() reads file, hashes via SHA256 (64 hex) or MD5 (32 hex), compares case-insensitively; Download() runs verification after progress Done(), cleans up on mismatch
internal/config/config.go — Checksum string, --checksum flag, PGET_CHECKSUM env var
cmd/pget/main.go — passes cfg.Checksum to Download()
ROADMAP.md — Marks Phase 4 checksum items as [x]

Output examples

Match: checksum verified (abc123...)
Mismatch: checksum mismatch: expected abc..., got def...
Bad length: unsupported checksum length 40 (expected 32 for MD5 or 64 for SHA256)

Closes #87, #88, #89, #90 on merge.

## Review: APPROVED ### Verification - `go vet ./...` — ✅ passes - `go build ./...` — ✅ passes - `golangci-lint v2 run ./...` — ✅ 0 issues ### Changes - `internal/downloader/download.go` — `verifyChecksum()` reads file, hashes via SHA256 (64 hex) or MD5 (32 hex), compares case-insensitively; `Download()` runs verification after progress Done(), cleans up on mismatch - `internal/config/config.go` — `Checksum string`, `--checksum` flag, `PGET_CHECKSUM` env var - `cmd/pget/main.go` — passes `cfg.Checksum` to `Download()` - ROADMAP.md — Marks Phase 4 checksum items as [x] ### Output examples - Match: `checksum verified (abc123...)` - Mismatch: `checksum mismatch: expected abc..., got def...` - Bad length: `unsupported checksum length 40 (expected 32 for MD5 or 64 for SHA256)` Closes #87, #88, #89, #90 on merge.

fuzzy merged commit 27b8f1323e into main

2026-07-14 05:57:33 +00:00

fuzzy deleted branch feature/checksum-verification

2026-07-14 05:57:33 +00:00