move into sonardesk

Marketplace/Services/PackageVerifier.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Modules\Marketplace\Services;
+
+use RuntimeException;
+
+final class PackageVerifier
+{
+    public function verify(string $path, array $manifest, ?string $expectedChecksum = null): array
+    {
+        if (! is_file($path)) {
+            throw new RuntimeException("Package archive [$path] does not exist.");
+        }
+        $actual = hash_file('sha256', $path);
+        $expected = $expectedChecksum ?: ($manifest['checksum'] ?? null);
+        if (config('marketplace.require_checksum', true) && blank($expected)) {
+            throw new RuntimeException('A SHA-256 checksum is required.');
+        }
+        if (filled($expected) && ! hash_equals(strtolower((string) $expected), strtolower($actual))) {
+            throw new RuntimeException('Package checksum verification failed.');
+        }
+        if (config('marketplace.require_signature', false) && blank($manifest['signature'] ?? null)) {
+            throw new RuntimeException('A package signature is required.');
+        }
+
+        return ['verified' => true, 'checksum' => $actual, 'signature_present' => filled($manifest['signature'] ?? null)];
+    }
+}