{"record":{"id":"1ac0c1ec68e69a43","repo":"multica-ai/multica","slug":"verify-download-w","errorCode":null,"errorMessage":"verify download: %w","messagePattern":"verify download: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/internal/cli/update.go","lineNumber":427,"sourceCode":"\t}\n\n\t// Buffer the archive into memory so we can verify the full SHA-256\n\t// before writing anything to disk. Release archives are ~10–30 MB; the\n\t// extraction code already buffers zip archives in full (random access\n\t// requirement), so this is not a new memory cost on Windows. For tar.gz\n\t// it adds a single in-RAM copy, which is preferable to running the\n\t// untrusted bytes through gzip+tar extraction before the SHA-256 check.\n\tarchiveData, err := fetchURLBytes(downloadURL, timeout)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"download failed: %w\", err)\n\t}\n\n\tif err := verifyAssetSHA256(archiveData, expectedSum, assetName); err != nil {\n\t\t// Do NOT extract or replace; the next poll tick will retry. A\n\t\t// corrupted asset is rare enough that retrying through the same\n\t\t// CDN is the right default; persistent failures will surface in\n\t\t// the daemon log.\n\t\treturn \"\", fmt.Errorf(\"verify download: %w\", err)\n\t}\n\n\t// Extract the binary from the archive.\n\tbinaryName := \"multica\"\n\tif runtime.GOOS == \"windows\" {\n\t\tbinaryName = \"multica.exe\"\n\t}\n\tvar binaryData []byte\n\tif runtime.GOOS == \"windows\" {\n\t\tbinaryData, err = extractBinaryFromZip(bytes.NewReader(archiveData), binaryName)\n\t} else {\n\t\tbinaryData, err = extractBinaryFromTarGz(bytes.NewReader(archiveData), binaryName)\n\t}\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"extract binary: %w\", err)\n\t}\n\n\t// Atomic replace: write to temp file, then rename over the original.","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/cli/update.go#L409-L445","documentation":"After buffering the archive, verifyAssetSHA256 recomputes the SHA-256 and compares it against the manifest entry; mismatch is wrapped as 'verify download: %w'. This guard intentionally runs before extraction so untrusted bytes never reach gzip/tar/zip parsing. On failure nothing is written and the binary is left untouched; the poller retries later.","triggerScenarios":"A truncated or corrupted download (connection cut mid-body with a misleading Content-Length); an asset re-uploaded after checksums.txt was generated so the manifest is stale; a proxy/MITM mangling the body; a manifest collision on duplicate filename entries.","commonSituations":"Flaky networks delivering partial bodies; release pipelines that upload archives, then regenerate one asset without refreshing checksums.txt; corporate TLS-inspection appliances altering content.","solutions":["Retry on the next poll tick — the code deliberately does not extract or replace on mismatch, and transient corruption usually clears.","Compare the downloaded asset's SHA-256 manually (curl the asset, shasum -a 256) against checksums.txt to confirm a stale manifest.","If the manifest is stale, re-run the release job to regenerate checksums.txt for all assets.","Disable any content-rewriting proxy for objects.githubusercontent.com."],"exampleFix":"null","handlingStrategy":"retry","validationCode":null,"typeGuard":"func isVerifyFailure(err error) bool {\n    return err != nil && strings.HasPrefix(err.Error(), \"verify download\")\n}","tryCatchPattern":"out, err := cli.UpdateViaDownload(ver)\nif err != nil && isVerifyFailure(err) {\n    // binary untouched by design; retry via same CDN on next poll tick.\n    // persistent failure => stale checksums.txt on the release: re-release.\n    return scheduleRetry(err)\n}","preventionTips":["Always regenerate checksums.txt when re-uploading any release asset","Never bypass the SHA-256 check to 'get the update through'","Alert when verification fails persistently — it indicates release-side drift"],"tags":["checksum","sha256","integrity","download"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}