Release 3.8.0.1: unify apphost, harden lifecycle and core SHA checks.

internal/protocols/xray/binary.go

@@ -2,16 +2,15 @@ package xray
 
 import (
 	"archive/zip"
-	"encoding/json"
 	"fmt"
 	"io"
-	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strings"
-	"time"
+
+	"vpnclient/internal/coredl"
 )
 
 const githubAPILatest = "https://api.github.com/repos/XTLS/Xray-core/releases/latest"
@@ -56,13 +55,17 @@ func EnsureBinary(binDir string) (string, error) {
 		return "", err
 	}
 	fmt.Fprintf(os.Stderr, "downloading official Xray-core (%s)...\n", want)
-	name, url, err := findReleaseAsset(want)
+	asset, all, err := findReleaseAsset(want)
 	if err != nil {
 		return "", err
 	}
-	zipPath := filepath.Join(binDir, name+".download")
+	sum, err := coredl.ResolveSHA(asset, all)
+	if err != nil {
+		return "", err
+	}
+	zipPath := filepath.Join(binDir, asset.Name+".download")
 	_ = os.Remove(zipPath)
-	if err := downloadFile(zipPath, url); err != nil {
+	if err := coredl.DownloadAndVerify(zipPath, asset.BrowserDownloadURL, sum); err != nil {
 		return "", err
 	}
 	defer os.Remove(zipPath)
@@ -73,7 +76,6 @@ func EnsureBinary(binDir string) (string, error) {
 	}
 	dest := filepath.Join(binDir, destName)
 	if err := extractNamedFromZip(zipPath, destName, dest); err != nil {
-		// Some zips nest the binary; try case-insensitive match.
 		if err2 := extractXrayFromZip(zipPath, dest); err2 != nil {
 			return "", fmt.Errorf("%v; %w", err, err2)
 		}
@@ -104,65 +106,17 @@ func releaseZipName() (string, error) {
 	}
 }
 
-type ghRelease struct {
-	TagName string `json:"tag_name"`
-	Assets  []struct {
-		Name               string `json:"name"`
-		BrowserDownloadURL string `json:"browser_download_url"`
-	} `json:"assets"`
-}
-
-func findReleaseAsset(exactName string) (name, downloadURL string, err error) {
-	client := &http.Client{Timeout: 60 * time.Second}
-	req, err := http.NewRequest(http.MethodGet, githubAPILatest, nil)
+func findReleaseAsset(exactName string) (coredl.ReleaseAsset, []coredl.ReleaseAsset, error) {
+	_, assets, err := coredl.FetchLatestAssets(githubAPILatest)
 	if err != nil {
-		return "", "", err
+		return coredl.ReleaseAsset{}, nil, err
 	}
-	req.Header.Set("Accept", "application/vnd.github+json")
-	req.Header.Set("User-Agent", "navis-vpnclient")
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", "", fmt.Errorf("github api: %w", err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
-		return "", "", fmt.Errorf("github api: %s: %s", resp.Status, string(body))
-	}
-	var rel ghRelease
-	if err := json.NewDecoder(resp.Body).Decode(&rel); err != nil {
-		return "", "", err
-	}
-	for _, a := range rel.Assets {
-		if a.Name == exactName {
-			return a.Name, a.BrowserDownloadURL, nil
+	for _, a := range assets {
+		if a.Name == exactName || strings.EqualFold(a.Name, exactName) {
+			return a, assets, nil
 		}
 	}
-	for _, a := range rel.Assets {
-		if strings.EqualFold(a.Name, exactName) {
-			return a.Name, a.BrowserDownloadURL, nil
-		}
-	}
-	return "", "", fmt.Errorf("no asset %s in release %s", exactName, rel.TagName)
-}
-
-func downloadFile(path, url string) error {
-	client := &http.Client{Timeout: 15 * time.Minute}
-	resp, err := client.Get(url)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("download %s: %s", url, resp.Status)
-	}
-	f, err := os.Create(path)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-	_, err = io.Copy(f, io.LimitReader(resp.Body, 120<<20))
-	return err
+	return coredl.ReleaseAsset{}, assets, fmt.Errorf("no asset %s in xray release", exactName)
 }
 
 func extractNamedFromZip(zipPath, wantName, dest string) error {