Class DownloadVerifier

Namespace

McServerLauncher.Services

Assembly

McServerLauncher.dll

Verifies a downloaded file's hash against the checksum an official API (Mojang, Adoptium, Paper) already returns alongside the download URL. On mismatch the file is deleted and an exception is thrown, so a corrupted or tampered download is never silently trusted.

public static class DownloadVerifier

Inheritance

object

DownloadVerifier

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Whether a hash must exist is a decision, and it is made at the call: VerifyAsync(string, string?, HashAlgorithmName, CancellationToken) refuses a download it has no hash for, and VerifyIfProvidedAsync(string, string?, HashAlgorithmName, CancellationToken) is the one that lets it through. A single method that quietly did nothing for an empty hash made forgetting to demand one look the same as having chosen not to.

A hash from the same API that gave the link catches a truncated or corrupted file; it cannot catch an API that is itself lying, and an MD5 (Purpur publishes nothing else) not even a crafted file. Where the file is about to be run, the caller requires one and the publisher's host.

Methods

ComputeHashAsync(string, HashAlgorithmName, CancellationToken)

Computes the hex-encoded hash of a file in a streaming fashion (no full read into memory).

public static Task<string> ComputeHashAsync(string filePath, HashAlgorithmName algorithm, CancellationToken ct = default)

Parameters

filePath string

algorithm HashAlgorithmName

ct CancellationToken

Returns

Task<string>

VerifyAsync(string, string?, HashAlgorithmName, CancellationToken)

Verifies filePath against expectedHex using algorithm. Without an expected hash the file is deleted and this throws: nothing is accepted that could not be checked.

public static Task VerifyAsync(string filePath, string? expectedHex, HashAlgorithmName algorithm, CancellationToken ct = default)

Parameters

filePath string

expectedHex string

algorithm HashAlgorithmName

ct CancellationToken

Returns

Task

VerifyIfProvidedAsync(string, string?, HashAlgorithmName, CancellationToken)

Like VerifyAsync(string, string?, HashAlgorithmName, CancellationToken), but a null or empty expected hash means the API published none for this asset and the file is accepted unchecked. For downloads where that is the documented rule; saying so here keeps it visible at the call.

public static Task VerifyIfProvidedAsync(string filePath, string? expectedHex, HashAlgorithmName algorithm, CancellationToken ct = default)

Parameters

filePath string

expectedHex string

algorithm HashAlgorithmName

ct CancellationToken

Returns

Task