skills/pbakaus_impeccable
1
0
Fork 0
mirror of https://github.com/pbakaus/impeccable.git synced 2026-09-11 21:57:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

Sync generated provider output

Browse Source
This commit is contained in:
github-actions[bot]
2026-09-05 18:30:47 +00:00
parent 6e61113e3c
commit 94d8611af6
36 changed files with 1458 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.agent/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.agent/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.agents/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.agents/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.claude/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.claude/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.cursor/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.cursor/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.gemini/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.gemini/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.github/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.github/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.grok/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.grok/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.hermes/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.hermes/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.kiro/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.kiro/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.opencode/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.opencode/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.pi/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.pi/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.qoder/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.qoder/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.rovodev/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.rovodev/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.trae-cn/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.trae-cn/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.trae/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.trae/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.veto/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.veto/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
.vibe/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
.vibe/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b
plugin/skills/impeccable/scripts/impeccable
+38 -5
View File
@@ -96,6 +96,19 @@ fetch_url() {
return 1
fi
}
check_download() {
download_file=${1:-$tmp}
if [ ! -f "$download_file" ]; then
rm -f "$tmp.sha256"
echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
exit 127
fi
if [ ! -s "$download_file" ]; then
rm -f "$download_file" "$tmp.sha256"
echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
exit 127
fi
}
if [ -n "$probing" ]; then
# Inside another launcher's probe: no download, fail fast and quiet.
exit 127
@@ -116,6 +129,7 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
fetch_url "$url" && fetched=1
fi
if [ "$fetched" = 1 ]; then
check_download
# Fail closed: a freshly downloaded binary runs only after verifying
# against its .sha256 sidecar. A sidecar that cannot be fetched, or a
# machine with no sha256 tool, refuses the download instead of exec'ing
@@ -127,15 +141,20 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
elif command -v wget >/dev/null 2>&1; then
wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
fi
check_download
expected=""
[ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
actual=""
if command -v shasum >/dev/null 2>&1; then actual=$(shasum -a 256 "$tmp" | cut -d' ' -f1)
elif command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp" | cut -d' ' -f1); fi
if command -v shasum >/dev/null 2>&1; then
if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
elif command -v sha256sum >/dev/null 2>&1; then
if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
fi
check_download
rm -f "$tmp.sha256"
if [ -z "$expected" ] || [ -z "$actual" ]; then
rm -f "$tmp"
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or no sha256 tool); refusing the unverified download" >&2
echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
exit 127
fi
if [ "$actual" != "$expected" ]; then
@@ -143,8 +162,22 @@ if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
echo "impeccable: checksum mismatch downloading $url" >&2
exit 127
fi
chmod +x "$tmp" 2>/dev/null
mv -f "$tmp" "$cached" && exec "$cached" "$@"
check_download
if ! chmod +x "$tmp" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not make the verified download executable: $url" >&2
exit 127
fi
check_download
if ! mv -f "$tmp" "$cached" 2>/dev/null; then
check_download
rm -f "$tmp"
echo "impeccable: could not cache the verified download: $url" >&2
exit 127
fi
check_download "$cached"
exec "$cached" "$@"
fi
rm -f "$tmp" 2>/dev/null
fi
plugin/skills/impeccable/scripts/impeccable.cmd
+43 -2
View File
@@ -82,6 +82,8 @@ curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
if errorlevel 1 goto fail
:verify
call :check_download
if errorlevel 1 exit /b 127
rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
rem runs only after verifying against its .sha256 sidecar. A sidecar that
rem cannot be fetched, or an empty certutil result, refuses the download
@@ -91,8 +93,16 @@ if errorlevel 1 goto verify_refuse
set "expected="
set /p expected=<"%cached%.sha256"
for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
call :check_download
if errorlevel 1 exit /b 127
set "actual="
for /f "skip=1 delims=" %%h in ('certutil -hashfile "%cached%.part" SHA256 2^>nul') do if not defined actual set "actual=%%h"
rem Reuse the sidecar staging file after reading expected. Check certutil's
rem status before parsing: its error text on stdout is not a digest.
certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
if errorlevel 1 goto verify_refuse
call :check_download
if errorlevel 1 exit /b 127
for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
del "%cached%.sha256" >nul 2>nul
if not defined expected goto verify_refuse
if not defined actual goto verify_refuse
@@ -103,17 +113,48 @@ echo impeccable: checksum mismatch downloading %url% 1>&2
exit /b 127
:verify_refuse
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
exit /b 127
:check_download
set "download_file=%~1"
if not defined download_file set "download_file=%cached%.part"
if not exist "%download_file%" goto download_missing
for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
exit /b 0
:download_missing
del "%cached%.sha256" >nul 2>nul
echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
exit /b 127
:download_empty
del "%download_file%" >nul 2>nul
del "%cached%.sha256" >nul 2>nul
echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
exit /b 127
:place
call :check_download
if errorlevel 1 exit /b 127
move /y "%cached%.part" "%cached%" >nul 2>nul
if not exist "%cached%" goto fail
if errorlevel 1 goto place_failed
call :check_download "%cached%"
if errorlevel 1 exit /b 127
set "run=%cached%"
goto run
:place_failed
call :check_download
if errorlevel 1 exit /b 127
del "%cached%.part" >nul 2>nul
echo impeccable: could not cache the verified download: %url% 1>&2
exit /b 127
:run
"%run%" %*
exit /b