29 lines
1.1 KiB
PHP
29 lines
1.1 KiB
PHP
<?php
|
|
|
|
namespace Modules\Marketplace\Services;
|
|
|
|
use RuntimeException;
|
|
|
|
final class PackageVerifier
|
|
{
|
|
public function verify(string $path, array $manifest, ?string $expectedChecksum = null): array
|
|
{
|
|
if (! is_file($path)) {
|
|
throw new RuntimeException("Package archive [$path] does not exist.");
|
|
}
|
|
$actual = hash_file('sha256', $path);
|
|
$expected = $expectedChecksum ?: ($manifest['checksum'] ?? null);
|
|
if (config('marketplace.require_checksum', true) && blank($expected)) {
|
|
throw new RuntimeException('A SHA-256 checksum is required.');
|
|
}
|
|
if (filled($expected) && ! hash_equals(strtolower((string) $expected), strtolower($actual))) {
|
|
throw new RuntimeException('Package checksum verification failed.');
|
|
}
|
|
if (config('marketplace.require_signature', false) && blank($manifest['signature'] ?? null)) {
|
|
throw new RuntimeException('A package signature is required.');
|
|
}
|
|
|
|
return ['verified' => true, 'checksum' => $actual, 'signature_present' => filled($manifest['signature'] ?? null)];
|
|
}
|
|
}
|