first with full handle over rpm

Signed-off-by: GnomeZworc <nicolas.boufidjeline@g3e.fr>

internal/clone/rpm/download.go

@@ -0,0 +1,71 @@
+package rpm
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+)
+
+func verifyChecksum(data []byte, expected string) error {
+	sum := sha256.Sum256(data)
+	got := hex.EncodeToString(sum[:])
+	if got != expected {
+		return fmt.Errorf("checksum mismatch: got %s, want %s", got, expected)
+	}
+	return nil
+}
+
+// DownloadAndVerify fetches url into destPath atomically (temp file + rename),
+// verifies the SHA256 checksum if checksumType is "sha256", and returns bytes written.
+func DownloadAndVerify(ctx context.Context, httpClient *http.Client, url, destPath, checksumType, expectedChecksum string) (int64, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return 0, err
+	}
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return 0, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return 0, fmt.Errorf("HTTP %d for %s", resp.StatusCode, url)
+	}
+
+	tmpPath := destPath + ".tmp"
+	if err := os.MkdirAll(filepath.Dir(tmpPath), 0o755); err != nil {
+		return 0, err
+	}
+
+	f, err := os.Create(tmpPath)
+	if err != nil {
+		return 0, err
+	}
+
+	h := sha256.New()
+	n, err := io.Copy(io.MultiWriter(f, h), resp.Body)
+	f.Close()
+	if err != nil {
+		os.Remove(tmpPath)
+		return 0, err
+	}
+
+	if checksumType == "sha256" && expectedChecksum != "" {
+		got := hex.EncodeToString(h.Sum(nil))
+		if got != expectedChecksum {
+			os.Remove(tmpPath)
+			return 0, fmt.Errorf("checksum mismatch for %s: got %s, want %s", url, got, expectedChecksum)
+		}
+	}
+
+	if err := os.Rename(tmpPath, destPath); err != nil {
+		os.Remove(tmpPath)
+		return 0, err
+	}
+	return n, nil
+}