{"record":{"id":"552ab3e4d4c0b31f","repo":"tonhowtf/omniget","slug":"yt-dlp-verificacao-de-integridade-impossivel","errorCode":null,"errorMessage":"yt-dlp: verificacao de integridade impossivel — {}","messagePattern":"yt-dlp: verificacao de integridade impossivel — (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src-tauri/omniget-core/src/core/ytdlp.rs","lineNumber":1873,"sourceCode":"\n    if !response.status().is_success() {\n        return Err(anyhow!(\n            \"Failed to download yt-dlp: HTTP {}\",\n            response.status()\n        ));\n    }\n\n    let bytes = response.bytes().await?;\n\n    // Verify against the release's published checksums. Fail closed on a\n    // mismatch; fail open only when the sums file itself can't be fetched, so\n    // a transient GitHub hiccup doesn't block downloads entirely.\n    // Fail-closed. O yt-dlp publica `SHA2-256SUMS` em toda release; não\n    // conseguir buscá-lo é indistinguível de alguém suprimindo a verificação,\n    // então o binário é descartado em vez de instalado sem conferência.\n    let expected = integrity::expected_from_sums_url(&client, &sums_url, asset)\n        .await\n        .map_err(|e| anyhow!(\"yt-dlp: verificacao de integridade impossivel — {}\", e))?;\n    integrity::verify_sha256(&bytes, &expected, &format!(\"yt-dlp ({:?})\", channel))?;\n\n    let temp = target.with_file_name(format!(\n        \"{}.new\",\n        target\n            .file_name()\n            .and_then(|n| n.to_str())\n            .unwrap_or(\"yt-dlp\")\n    ));\n    let temp_clone = temp.clone();\n    tokio::task::spawn_blocking(move || std::fs::write(&temp_clone, &bytes))\n        .await\n        .map_err(|e| anyhow!(\"spawn_blocking failed: {}\", e))??;\n\n    crate::core::dependencies::replace_managed_binary(&temp, &target)?;\n\n    #[cfg(unix)]\n    {","sourceCodeStart":1855,"sourceCodeEnd":1891,"githubUrl":"https://github.com/tonhowtf/omniget/blob/8600b91f4246848bac346874daa9e61c1fc5677a/src-tauri/omniget-core/src/core/ytdlp.rs#L1855-L1891","documentation":"Before installing the downloaded yt-dlp, the code fetches the release's `SHA2-256SUMS` file and derives the expected hash. If that sums file cannot be retrieved, the code fails closed: it cannot distinguish a transient GitHub hiccup from an attacker suppressing the checksum, so the binary is discarded and this error is raised. The message embeds the underlying cause.","triggerScenarios":"`integrity::expected_from_sums_url` fails — sums URL unreachable, HTTP error, asset absent from SHA2-256SUMS, or network/timeout problems while fetching the checksum file.","commonSituations":"GitHub outage or rate limiting while fetching SHA2-256SUMS; corporate proxy stripping the request; a release published without the checksum file; tampering/MitM attempts (the fail-closed case this exists for).","solutions":["Retry — a transient GitHub failure is the most common cause; ensure the whole release (asset + sums) is fetchable.","Check proxy/firewall allows reaching the sums URL on the same host as the asset.","Verify the target release actually publishes SHA2-256SUMS; pin to a release that does.","If it persists, compare the asset hash manually against the published sums to rule out tampering, then investigate network paths."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight: confirm the sums file is reachable before starting the download\nlet sums_ok = client.head(&sums_url).send().await\n    .map(|r| r.status().is_success()).unwrap_or(false);\nif !sums_ok { eprintln!(\"SHA2-256SUMS unreachable; install will fail closed\"); }","typeGuard":null,"tryCatchPattern":"match download_ytdlp_binary().await {\n    Err(e) if e.to_string().contains(\"verificacao de integridade impossivel\") => {\n        // transient? retry after backoff; if persistent, verify hashes manually\n    }\n    other => other?,\n}","preventionTips":["Retry on first failure — GitHub hiccups are the usual cause.","Never bypass the checksum requirement; treat persistent failure as a network or tampering signal.","Pin to releases that publish SHA2-256SUMS.","Monitor the release host's status before mass rollouts."],"tags":["integrity","sha256","checksum","security","yt-dlp","rust"],"backgroundTag":"checksum-mismatch","analyzedSha":"8600b91f4246848bac346874daa9e61c1fc5677a","analyzedAt":"2026-09-12T14:29:19.317Z","contentChangedAt":"2026-09-12T14:29:19.317Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}