Marketplace package catalogue

* Modules, themes, and extensions * Publisher profiles and verification metadata * Installed-package tracking * Semantic version compatibility checks * PHP, Laravel, and Content Manager compatibility checks * Dependency resolution * SHA-256 checksum validation * Package signature requirements * Installation and update history * Enable and disable controls * Removal handling * Rollback records * Licence records * Marketplace administration UI * Authenticated REST endpoints * Console audit and synchronisation commands * Permissions and sidebar integration * Feature tests
2026-07-24 13:49:14 +01:00
parent 673554d92d
commit f09a680531
29 changed files with 617 additions and 11 deletions
@@ -0,0 +1,16 @@
+<?php
+namespace Modules\Marketplace\Services;
+use RuntimeException;
+final class PackageVerifier
+{
+    public function verify(string $path,array $manifest,?string $expectedChecksum=null): array
+    {
+        if (!is_file($path)) throw new RuntimeException("Package archive [$path] does not exist.");
+        $actual=hash_file('sha256',$path);
+        $expected=$expectedChecksum ?: ($manifest['checksum'] ?? null);
+        if (config('marketplace.require_checksum',true) && blank($expected)) throw new RuntimeException('A SHA-256 checksum is required.');
+        if (filled($expected) && !hash_equals(strtolower((string)$expected),strtolower($actual))) throw new RuntimeException('Package checksum verification failed.');
+        if (config('marketplace.require_signature',false) && blank($manifest['signature'] ?? null)) throw new RuntimeException('A package signature is required.');
+        return ['verified'=>true,'checksum'=>$actual,'signature_present'=>filled($manifest['signature'] ?? null)];
+    }
+}