mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-29 07:13:44 +08:00
cbm_cli_sha256_file shelled out to sha256sum/shasum, which is unportable: the tool may be absent, and under cmd.exe the single-quoted path is not dequoted so the hash of a downloaded release could never be computed on Windows. Add a small in-process SHA-256 (FIPS 180-4, src/foundation/sha256.c) and use it directly — no external tool, no per-OS branching, no popen. The checksum test now covers three NIST vectors (empty, "abc", and a 56-byte input that forces padding into a second block). Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>