Package com.ultikits.ultitools.utils

Class VerifiedDownload

java.lang.Object

com.ultikits.ultitools.utils.VerifiedDownload

final class VerifiedDownload
extends Object

Downloads a module JAR and verifies it before anything may use it (plan 22-18, D-28, S-23).

A catalogue answer is metadata on the outside of a file: the version names the byte count and the SHA-256 of the JAR it offers, and the download response repeats the hash in X-Content-SHA256. This class accepts a downloaded file only when the byte count equals the metadata's sizeBytes, the file's own SHA-256 equals the metadata's sha256, and the response header, when present, names that same hash. Upper-case hex is accepted from either source; the comparison itself is plain equality, because these are public values and a timing attack on a public hash buys nothing.

Metadata without a usable hash or byte count is refused, never treated as "no check": a catalogue that omits the hash cannot downgrade verification. A body longer than sizeBytes is cut off while streaming instead of being read to the end, and a 3xx is never followed, so the JAR always comes from the host the base URL names.

The temporary file never survives a failed verification. It is the caller's file, named inside the modules folder so that accepting it stays one atomic rename.

Since:

6.3.1

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
(package private) static enum	VerifiedDownload.Kind	Why a download was or was not accepted.
(package private) static final class	VerifiedDownload.Result	What one verified download did.

Field Summary

Fields

Modifier and Type	Field	Description
private static final int	SHA256_HEX_LENGTH

Constructor Summary

Constructors

Modifier	Constructor	Description
private	VerifiedDownload()

Method Summary

Modifier and Type	Method	Description
private static void	deleteQuietly(Path file)
(package private) static VerifiedDownload.Result	fetch(String url, String expectedSha256, long expectedSize, Path tempFile)	Downloads url into tempFile and verifies it.
(package private) static boolean	isSha256Hex(String value)
(package private) static String	shortHash(String hash)
private static VerifiedDownload.Kind	verdictOf(CatalogueHttp.Download download, String expectedSha256, long expectedSize)
private static VerifiedDownload.Kind	verdictOfCompleted(CatalogueHttp.Download download, String expectedSha256, long expectedSize)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SHA256_HEX_LENGTH

private static final int SHA256_HEX_LENGTH

See Also:

• Constant Field Values

Constructor Details

VerifiedDownload

private VerifiedDownload()

Method Details

fetch

static VerifiedDownload.Result fetch(String url,
 String expectedSha256,
 long expectedSize,
 Path tempFile)

Downloads url into tempFile and verifies it.

Parameters:

url - the absolute download URL, or null when the version offers none

expectedSha256 - the version's sha256, as it was written

expectedSize - the version's sizeBytes

tempFile - the file to write and, on success, to keep

Returns:

the outcome; never null

verdictOf

private static VerifiedDownload.Kind verdictOf(CatalogueHttp.Download download,
 String expectedSha256,
 long expectedSize)

verdictOfCompleted

private static VerifiedDownload.Kind verdictOfCompleted(CatalogueHttp.Download download,
 String expectedSha256,
 long expectedSize)

isSha256Hex

static boolean isSha256Hex(String value)

Parameters:

value - a value as written

Returns:

whether it is exactly 64 hexadecimal characters

shortHash

static String shortHash(String hash)

Parameters:

hash - a hash as written

Returns:

at most the first 12 characters, for a local diagnostic line

deleteQuietly

private static void deleteQuietly(Path file)