From e12160f05cafa8540b22c321a45ec7d4ad30bfc4 Mon Sep 17 00:00:00 2001 From: Alex Dunmow Date: Sun, 5 Jul 2026 08:59:28 +0800 Subject: [PATCH] fix(backup): checksum is base64-of-SHA256 to match cms restore verification Co-Authored-By: Claude Fable 5 --- backup/archive.go | 13 ++++++++++--- backup/archive_test.go | 4 ++-- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/backup/archive.go b/backup/archive.go index 80f540d..6c2b054 100644 --- a/backup/archive.go +++ b/backup/archive.go @@ -4,7 +4,7 @@ import ( "archive/zip" "context" "crypto/sha256" - "encoding/hex" + "encoding/base64" "encoding/json" "fmt" "io" @@ -100,8 +100,7 @@ func BuildArchive(ctx context.Context, w io.Writer, in BuildInput) (*Manifest, [ } // Checksum of the unencrypted dump. - sum := sha256.Sum256(in.Dump) - checksum := hex.EncodeToString(sum[:]) + checksum := computeChecksum(in.Dump) // Encrypt the dump. encryptedDump, encParams, err := EncryptWithPassword(in.Dump, in.Password) @@ -222,3 +221,11 @@ func BuildArchive(ctx context.Context, w io.Writer, in BuildInput) (*Manifest, [ func closeBestEffort(c io.Closer) { _ = c.Close() } + +// computeChecksum calculates the SHA-256 hash of data, base64-encoded — +// byte-identical to the cms computeChecksum so the existing cms restore path +// (verifyChecksum) accepts archives built by this package. +func computeChecksum(data []byte) string { + hash := sha256.Sum256(data) + return base64.StdEncoding.EncodeToString(hash[:]) +} diff --git a/backup/archive_test.go b/backup/archive_test.go index 6452dd5..60aecda 100644 --- a/backup/archive_test.go +++ b/backup/archive_test.go @@ -5,7 +5,7 @@ import ( "bytes" "context" "crypto/sha256" - "encoding/hex" + "encoding/base64" "io" "os" "path/filepath" @@ -70,7 +70,7 @@ func TestBuildArchiveRoundTrip(t *testing.T) { t.Fatalf("counts: media=%d brand=%d", manifest.MediaCount, manifest.BrandCount) } wantSum := sha256.Sum256(dump) - if manifest.Checksum != hex.EncodeToString(wantSum[:]) { + if manifest.Checksum != base64.StdEncoding.EncodeToString(wantSum[:]) { t.Fatalf("checksum mismatch") }