From 0936d76ac69fe67728b900dbd2d3b98c4fc8c8ef Mon Sep 17 00:00:00 2001 From: Bornoz Date: Tue, 1 Sep 2026 15:39:36 +0300 Subject: [PATCH 1/2] fix(arcup): accept a valid checksum written in uppercase hex MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit verify_checksum_file accepts a checksum whose hash matches ^[0-9A-Fa-f]{64}$ — either case — but then compares it against compute_sha256, which always returns lowercase (sha256sum and shasum both do). The comparison is case-sensitive, so a correct digest written in uppercase fails as "Checksum verification failed" and the install is refused for a genuine release. Fold the expected checksum to lowercase before comparing, the same normalization detect_platform already applies to uname output. Adds an uppercase case to test_checksum_validation, which fails on main and passes with the fix. --- arcup/arcup | 5 +++++ arcup/test_arcup.sh | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/arcup/arcup b/arcup/arcup index 3590cd36..ca79cf82 100755 --- a/arcup/arcup +++ b/arcup/arcup @@ -664,6 +664,11 @@ verify_checksum_file() { error "Checksum file has invalid SHA-256 hash: $checksum_path" fi + # sha256sum and shasum both print lowercase, but the format accepted above allows + # either case, so fold to lowercase before comparing — otherwise a valid digest + # written in uppercase fails as a mismatch. Same normalization detect_platform uses. + expected_checksum="$(printf '%s' "$expected_checksum" | tr '[:upper:]' '[:lower:]')" + if [[ -n "$expected_name" ]]; then expected_name="${expected_name#\*}" expected_name="${expected_name##*/}" diff --git a/arcup/test_arcup.sh b/arcup/test_arcup.sh index 49021191..577a800d 100755 --- a/arcup/test_arcup.sh +++ b/arcup/test_arcup.sh @@ -117,6 +117,10 @@ test_checksum_validation() { verify_checksum_file "$archive" "$checksum_file" "$archive_name" pass "valid checksum file passes" + printf '%s %s\n' "$(printf '%s' "$checksum" | tr '[:lower:]' '[:upper:]')" "$archive_name" > "$checksum_file" + verify_checksum_file "$archive" "$checksum_file" "$archive_name" + pass "uppercase checksum digest passes" + printf '%s other-asset.tar.gz\n' "$checksum" > "$checksum_file" expect_fail "checksum filename mismatch fails" verify_checksum_file "$archive" "$checksum_file" "$archive_name" } From 3a07773cc13ae637f6c1d647b522ef21c39dd8fe Mon Sep 17 00:00:00 2001 From: Bornoz Date: Thu, 10 Sep 2026 20:04:52 +0300 Subject: [PATCH 2/2] chore(arcup): increment installer version for the checksum fix The script header requires incrementing ARCUP_INSTALLER_VERSION for any modification to arcup, and the self-update check compares it against the copy on main to tell a user their installer is stale. This change edits arcup, so it owes the bump. Test suite stays at 26/26: the self-update fixture serves 0.2.0 as the remote version, so a local 0.2.1 is simply not older and nothing is advertised as an update. --- arcup/arcup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arcup/arcup b/arcup/arcup index ca79cf82..8deb997c 100755 --- a/arcup/arcup +++ b/arcup/arcup @@ -6,7 +6,7 @@ set -euo pipefail # NOTE: if you make modifications to this script, please increment the version number. # WARNING: the SemVer pattern: major.minor.patch must be followed as we use it to determine if the script is up to date. -ARCUP_INSTALLER_VERSION="0.2.0" +ARCUP_INSTALLER_VERSION="0.2.1" REPO="${ARC_REPO:-circlefin/arc-node}" if [[ -n "${ARC_REPO:-}" ]] && [[ ! "$ARC_REPO" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then