Mark Gregory
f09a680531
* Modules, themes, and extensions * Publisher profiles and verification metadata * Installed-package tracking * Semantic version compatibility checks * PHP, Laravel, and Content Manager compatibility checks * Dependency resolution * SHA-256 checksum validation * Package signature requirements * Installation and update history * Enable and disable controls * Removal handling * Rollback records * Licence records * Marketplace administration UI * Authenticated REST endpoints * Console audit and synchronisation commands * Permissions and sidebar integration * Feature tests
17 lines
1008 B
PHP
17 lines
1008 B
PHP
<?php
|
|
namespace Modules\Marketplace\Services;
|
|
use RuntimeException;
|
|
final class PackageVerifier
|
|
{
|
|
public function verify(string $path,array $manifest,?string $expectedChecksum=null): array
|
|
{
|
|
if (!is_file($path)) throw new RuntimeException("Package archive [$path] does not exist.");
|
|
$actual=hash_file('sha256',$path);
|
|
$expected=$expectedChecksum ?: ($manifest['checksum'] ?? null);
|
|
if (config('marketplace.require_checksum',true) && blank($expected)) throw new RuntimeException('A SHA-256 checksum is required.');
|
|
if (filled($expected) && !hash_equals(strtolower((string)$expected),strtolower($actual))) throw new RuntimeException('Package checksum verification failed.');
|
|
if (config('marketplace.require_signature',false) && blank($manifest['signature'] ?? null)) throw new RuntimeException('A package signature is required.');
|
|
return ['verified'=>true,'checksum'=>$actual,'signature_present'=>filled($manifest['signature'] ?? null)];
|
|
}
|
|
}
|