Release 3.8.0.1: unify apphost, harden lifecycle and core SHA checks.

internal/protocols/naive/binary.go

@@ -2,16 +2,15 @@ package naive
 
 import (
 	"archive/zip"
-	"encoding/json"
 	"fmt"
 	"io"
-	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
-	"time"
+
+	"vpnclient/internal/coredl"
 )
 
 const githubAPILatest = "https://api.github.com/repos/klzgrad/naiveproxy/releases/latest"
@@ -51,12 +50,16 @@ func EnsureBinary(binDir string) (string, error) {
 		return "", err
 	}
 	fmt.Fprintf(os.Stderr, "downloading official naiveproxy release (%s)...\n", pattern)
-	assetName, url, err := findReleaseAsset(pattern)
+	asset, all, err := findReleaseAsset(pattern)
 	if err != nil {
 		return "", err
 	}
-	archivePath := filepath.Join(binDir, assetName)
-	if err := downloadFile(archivePath, url); err != nil {
+	sum, err := coredl.ResolveSHA(asset, all)
+	if err != nil {
+		return "", err
+	}
+	archivePath := filepath.Join(binDir, asset.Name+".download")
+	if err := coredl.DownloadAndVerify(archivePath, asset.BrowserDownloadURL, sum); err != nil {
 		return "", err
 	}
 	defer os.Remove(archivePath)
@@ -88,52 +91,26 @@ func assetNameForPlatform() (string, error) {
 	case runtime.GOOS == "linux" && runtime.GOARCH == "amd64":
 		return "naiveproxy-*-linux-x64.zip", nil
 	case runtime.GOOS == "darwin" && runtime.GOARCH == "amd64":
-		// Newer releases use mac-x64-x64; older used mac-x64.
 		return "naiveproxy-*-mac-x64", nil
 	case runtime.GOOS == "darwin" && runtime.GOARCH == "arm64":
-		// Newer releases use mac-arm64-arm64; older used mac-arm64.
 		return "naiveproxy-*-mac-arm64", nil
 	default:
 		return "", fmt.Errorf("unsupported platform %s/%s for auto-download; place naive binary in bin/", runtime.GOOS, runtime.GOARCH)
 	}
 }
 
-type ghRelease struct {
-	TagName string `json:"tag_name"`
-	Assets  []struct {
-		Name               string `json:"name"`
-		BrowserDownloadURL string `json:"browser_download_url"`
-	} `json:"assets"`
-}
-
-func findReleaseAsset(pattern string) (name, downloadURL string, err error) {
-	client := &http.Client{Timeout: 60 * time.Second}
-	req, err := http.NewRequest(http.MethodGet, githubAPILatest, nil)
+func findReleaseAsset(pattern string) (coredl.ReleaseAsset, []coredl.ReleaseAsset, error) {
+	_, assets, err := coredl.FetchLatestAssets(githubAPILatest)
 	if err != nil {
-		return "", "", err
-	}
-	req.Header.Set("Accept", "application/vnd.github+json")
-	req.Header.Set("User-Agent", "vpnclient-go")
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", "", fmt.Errorf("github api: %w", err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
-		return "", "", fmt.Errorf("github api: %s: %s", resp.Status, string(body))
-	}
-	var rel ghRelease
-	if err := json.NewDecoder(resp.Body).Decode(&rel); err != nil {
-		return "", "", err
+		return coredl.ReleaseAsset{}, nil, err
 	}
 	prefix := strings.Split(pattern, "*")[0]
 	needle := ""
 	if parts := strings.SplitN(pattern, "*", 2); len(parts) == 2 {
 		needle = parts[1]
 	}
-	var bestName, bestURL string
-	for _, a := range rel.Assets {
+	var best coredl.ReleaseAsset
+	for _, a := range assets {
 		name := a.Name
 		if strings.Contains(name, "plugin") {
 			continue
@@ -144,41 +121,22 @@ func findReleaseAsset(pattern string) (name, downloadURL string, err error) {
 		if needle != "" && !strings.Contains(name, needle) {
 			continue
 		}
-		// Prefer desktop archives over openwrt/apk.
 		if strings.HasSuffix(name, ".zip") || strings.HasSuffix(name, ".tar.xz") || strings.HasSuffix(name, ".txz") {
-			return name, a.BrowserDownloadURL, nil
+			return a, assets, nil
 		}
-		if bestName == "" {
-			bestName, bestURL = name, a.BrowserDownloadURL
+		if best.Name == "" {
+			best = a
 		}
 	}
-	if bestName != "" {
-		return bestName, bestURL, nil
+	if best.Name != "" {
+		return best, assets, nil
 	}
-	return "", "", fmt.Errorf("no asset matching %s in release %s", pattern, rel.TagName)
-}
-
-func downloadFile(path, url string) error {
-	client := &http.Client{Timeout: 10 * time.Minute}
-	resp, err := client.Get(url)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("download %s: %s", url, resp.Status)
-	}
-	f, err := os.Create(path)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	_, err = io.Copy(f, io.LimitReader(resp.Body, 120<<20))
-	return err
+	return coredl.ReleaseAsset{}, assets, fmt.Errorf("no asset matching %s in naive release", pattern)
 }
 
 func extractNaiveArchive(archivePath, destDir string) error {
 	lower := strings.ToLower(archivePath)
+	lower = strings.TrimSuffix(lower, ".download")
 	switch {
 	case strings.HasSuffix(lower, ".zip"):
 		return unzipNaive(archivePath, destDir)