Harden updater integrity checks with latest.yml SHA512 fallback

tests/update.test.ts

@@ -11,6 +11,10 @@ function sha256Hex(buffer: Buffer): string {
   return crypto.createHash("sha256").update(buffer).digest("hex");
 }
 
+function sha512Hex(buffer: Buffer): string {
+  return crypto.createHash("sha512").update(buffer).digest("hex");
+}
+
 afterEach(() => {
   globalThis.fetch = originalFetch;
   vi.restoreAllMocks();
@@ -287,6 +291,77 @@ describe("update", () => {
     expect(result.message).toMatch(/integrit|sha256|mismatch/i);
   });
 
+  it("uses latest.yml SHA512 digest when API asset digest is missing", async () => {
+    const executablePayload = fs.readFileSync(process.execPath);
+    const digestSha512Hex = sha512Hex(executablePayload);
+    const digestSha512Base64 = Buffer.from(digestSha512Hex, "hex").toString("base64");
+    const requestedUrls: string[] = [];
+
+    globalThis.fetch = (async (input: RequestInfo | URL): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      requestedUrls.push(url);
+
+      if (url.endsWith("/releases/tags/v9.9.9")) {
+        return new Response(JSON.stringify({
+          tag_name: "v9.9.9",
+          draft: false,
+          prerelease: false,
+          assets: [
+            {
+              name: "Real-Debrid-Downloader Setup 9.9.9.exe",
+              browser_download_url: "https://example.invalid/setup-no-digest.exe"
+            },
+            {
+              name: "latest.yml",
+              browser_download_url: "https://example.invalid/latest.yml"
+            }
+          ]
+        }), {
+          status: 200,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+
+      if (url.includes("latest.yml")) {
+        return new Response(
+          `version: 9.9.9\npath: Real-Debrid-Downloader-Setup-9.9.9.exe\nsha512: ${digestSha512Base64}\n`,
+          {
+            status: 200,
+            headers: { "Content-Type": "text/yaml" }
+          }
+        );
+      }
+
+      if (url.includes("setup-no-digest.exe")) {
+        return new Response(executablePayload, {
+          status: 200,
+          headers: {
+            "Content-Type": "application/octet-stream",
+            "Content-Length": String(executablePayload.length)
+          }
+        });
+      }
+
+      return new Response("missing", { status: 404 });
+    }) as typeof fetch;
+
+    const prechecked: UpdateCheckResult = {
+      updateAvailable: true,
+      currentVersion: APP_VERSION,
+      latestVersion: "9.9.9",
+      latestTag: "v9.9.9",
+      releaseUrl: "https://codeberg.org/owner/repo/releases/tag/v9.9.9",
+      setupAssetUrl: "https://example.invalid/setup-no-digest.exe",
+      setupAssetName: "Real-Debrid-Downloader Setup 9.9.9.exe",
+      setupAssetDigest: ""
+    };
+
+    const result = await installLatestUpdate("owner/repo", prechecked);
+    expect(result.started).toBe(true);
+    expect(requestedUrls.some((url) => url.endsWith("/releases/tags/v9.9.9"))).toBe(true);
+    expect(requestedUrls.some((url) => url.includes("latest.yml"))).toBe(true);
+  });
+
   it("emits install progress events while downloading and launching update", async () => {
     const executablePayload = fs.readFileSync(process.execPath);
     const digest = sha256Hex(executablePayload);