class

Fluxion::Executor::Downloader

Fetches remote artifacts and refuses to hand back anything unverified.

Every rule here exists because the alternative is running someone else's bytes as root:

HTTPS only, host required, no credentials in the URL — and re-checked after redirects, since a redirect is an attacker-controllable hop.
A hard byte ceiling, enforced while streaming rather than after, so a hostile or broken server cannot exhaust memory or the disk.
The digest is computed over the bytes actually written, and a mismatch deletes the file before raising. There is no code path that returns a downloaded file whose digest was not checked.

Constants

CHUNK_BYTES = 64 * 1024

Read in chunks rather than whole so the ceiling is enforced continuously.

CONNECT_TIMEOUT = 30.seconds

MAX_ARTIFACT_BYTES = ((1_i64 * 1024) * 1024) * 1024

Artifacts and signatures.

MAX_KEY_BYTES = (16_i64 * 1024) * 1024

MAX_REDIRECTS = 5

Follows redirects manually so each hop is re-validated. A redirect that downgrades to HTTP, or grows credentials, is refused rather than followed.

MAX_TEXT_BYTES = (1_i64 * 1024) * 1024

Checksum documents and repository keys — small by nature, so a large one means something is wrong.

READ_TIMEOUT = 10.minutes

new(max_bytes : Int64 = MAX_ARTIFACT_BYTES)

download(url : String, destination : String) : String

Downloads to destination and returns the SHA-256 of what was written.

download_text(url : String) : String

Fetches a small text document, such as a checksums file.

download_verified(url : String, destination : String, expected : Checksum) : String

Downloads and verifies against expected, deleting the file on mismatch.

validate(url : String) : URI

Validates transport rules. Applied to the request URL and again to the final URL after redirects.