fix: update package checksum computed from wrong package bytes

[ModerRAS]

Summary

Fix a checksum mismatch that caused every update download to fail with System.IO.InvalidDataException: 更新包校验失败.

Root Cause

BuildPackageFile in TelegramSearchBot.UpdateBuilder had a two-pass design:

1. Pass 1: Build a temp package with manifest.Checksum = "", compute its SHA512 → tempHash
2. Pass 2: Embed tempHash into the manifest, rebuild the package → finalBytes
3. Store tempHash in the catalog entry, but write finalBytes to disk

Since finalBytes has a different manifest (containing the checksum), its actual SHA512 differs from tempHash. The catalog records the wrong checksum, and the client's VerifyPackageChecksum always rejects the downloaded package.

Fix

Single-pass approach. The manifest's Checksum field is never read during update (ExtractPackageToDirectory skips manifest.json, and verification uses the catalog entry's PackageChecksum). So skip the two-pass embedding entirely and compute SHA512 from the actual package bytes that get written to disk.

Changes

• TelegramSearchBot.UpdateBuilder/Program.cs BuildPackageFile(): removed the temp package / two-pass logic, now creates the package once and hashes the final bytes

Summary by CodeRabbit

• Refactor
  • Streamlined internal package build and verification process for improved efficiency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 19283d89-9ae9-4c9a-91c6-d11093975f8c

📥 Commits

Reviewing files that changed from the base of the PR and between 2c66d14 and 1413951.

📒 Files selected for processing (1)

• TelegramSearchBot.UpdateBuilder/Program.cs

---

📝 Walkthrough

Walkthrough

The BuildPackageFile function in UpdateBuilder/Program.cs has been refactored to compute the package checksum directly from the initial manifest bytes, eliminating the previous double-packaging step where a second manifest with the embedded checksum was created.

Changes

Cohort / File(s)	Summary
UpdateBuilder Checksum Computation TelegramSearchBot.UpdateBuilder/Program.cs	Simplified checksum derivation logic; removed re-packaging with embedded checksum, now computing checksum directly from initial package bytes while maintaining the same function return signature.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• feat: migrate app updates to Moder.Update #294: Introduces the UpdateBuilder implementation that this change refactors by streamlining the checksum computation and packaging workflow.

Poem

A rabbit hops through code so neat, 🐰
Removed the double-package beat,
One manifest, one checksum flow,
Simpler paths are best, we know!
Efficiency in every byte,
The builder's logic shines so bright! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: update package checksum computed from wrong package bytes' directly and clearly describes the main fix: the checksum computation was using incorrect package bytes, and this has been corrected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/update-package-checksum-mismatch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🔍 PR检查报告

📋 检查概览

• PR: fix: update package checksum computed from wrong package bytes #326
• 分支: fix/update-package-checksum-mismatch → master
• 触发事件: pull_request
• 提交: e976473

🧪 测试结果

平台	状态	详情
Ubuntu	🟢 成功	测试通过，产物已上传
Windows	🟢 成功	测试通过，产物已上传

📊 代码质量

• ✅ 代码格式化检查
• ✅ 安全漏洞扫描
• ✅ 依赖包分析
• ✅ 代码覆盖率收集

📁 测试产物

• 测试结果 artifacts 数量: 2
• 代码覆盖率已上传到Codecov

🔗 相关链接

• PR页面
• Actions日志

---

此报告由GitHub Actions自动生成