Michael Chus
a44133aff2
identifier-normalization, no-hardcoded-vendors, vendor-installer-verification, and build-version-display follow the go-database split: rules in contract.md, snippets in README.md. Routed contract reads get cheaper; examples stay available on demand. Lint now also rejects stale kit/patterns references. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
47 lines
1.1 KiB
Markdown
47 lines
1.1 KiB
Markdown
# Vendor Installer Verification Pattern Notes
|
|
|
|
This file keeps examples. The normative rules live in `contract.md`.
|
|
|
|
## Download Order
|
|
|
|
```sh
|
|
BASE_URL="https://vendor.example.com/downloads/${VERSION}"
|
|
BIN_FILE="/var/cache/vendor-${VERSION}.run"
|
|
SHA_FILE="/var/cache/vendor-${VERSION}.run.sha256sum"
|
|
|
|
# 1. Download checksum first
|
|
wget -q -O "$SHA_FILE" "${BASE_URL}/vendor-${VERSION}.run.sha256sum"
|
|
|
|
# 2. Download installer
|
|
wget --show-progress -O "$BIN_FILE" "${BASE_URL}/vendor-${VERSION}.run"
|
|
|
|
# 3. Verify
|
|
cd /var/cache
|
|
sha256sum -c "$SHA_FILE" || { echo "ERROR: sha256 mismatch"; rm -f "$BIN_FILE"; exit 1; }
|
|
```
|
|
|
|
## Cache with Verification
|
|
|
|
```sh
|
|
verify_cached() {
|
|
[ -s "$SHA_FILE" ] || return 1 # sha256 file missing or empty
|
|
[ -s "$BIN_FILE" ] || return 1 # binary missing or empty
|
|
cd "$(dirname "$BIN_FILE")"
|
|
sha256sum -c "$SHA_FILE" --status 2>/dev/null
|
|
}
|
|
|
|
if ! verify_cached; then
|
|
rm -f "$BIN_FILE" "$SHA_FILE"
|
|
# ... download and verify
|
|
else
|
|
echo "verified from cache"
|
|
fi
|
|
```
|
|
|
|
## Version Validation
|
|
|
|
```sh
|
|
curl -sIL "https://vendor.example.com/downloads/${VERSION}/installer.run" \
|
|
| grep -i 'http/\|content-length'
|
|
```
|