[RithvikReddy0-0]

Closes #1218

What

This is the follow-up @DeusData flagged in #1218: the error now tells "genuine but different layout" apart from tampering. Nothing is relaxed. The allowlist, the checksum gate and the exit code (1) are all unchanged. Only the diagnosis changes.

install.ps1 used to print error: unsafe or incomplete release archive for two opposite situations:

Archive	Before	After
Checksum OK, unsafe path (../evil.exe)	unsafe or incomplete	unsafe release archive
Checksum OK, duplicate / case-conflicting entry	unsafe or incomplete	unsafe release archive
Checksum OK, extra root file (e.g. old payload.exe)	unsafe or incomplete	release archive layout does not match this installer + what to do
Checksum OK, missing root file	unsafe or incomplete	same as above
Checksum OK, nested entry (sub/LICENSE)	unsafe or incomplete	same as above

The layout-mismatch message names the expected file set and the fix: run the install.ps1 shipped inside that release, or retry after the next release. That is the situation from #1218, where main's script ran ahead of the latest archive.

Ordering guarantee

Validation used to throw on the first bad entry it met. If the layout message had simply been bolted onto that single pass, an archive listing an unexpected file before a ../ entry would get the reassuring "genuine artifact" message and hide the hostile entry. This PR screens every entry for unsafe paths and duplicates first, and only then reaches a layout verdict. A hostile entry always wins, whatever its position.

The message is also deliberately limited to what the check proves. checksums.txt comes from the same $BaseUrl as the archive, so the message says the archive matches what that source published. It does not claim more than that, which matters when CBM_DOWNLOAD_URL is overridden.

Also fixes a stale comment ("official five entries" -> four).

Tests

• tests/test_windows_bundle_contract.sh: two new assertions. (1) The two messages are distinct and the old conflated string is gone. (2) The single $LayoutMismatch = $true verdict comes after the last unsafe-path and duplicate throw. Both fail on main and pass with this change.

• Behavioral run of the real install.ps1 against a loopback CBM_DOWNLOAD_URL serving 9 fixture archives, each with a matching checksums.txt (bad-checksum case excepted):

  • good -> passes validation (then fails only because the fixture .exe is fake)
  • extra, missing, nested -> layout mismatch, exit 1
  • traversal, casedup -> unsafe, exit 1
  • extra_then_traversal, extra_then_casedup -> unsafe, exit 1 (the ordering case)
  • badsum -> CHECKSUM MISMATCH, exit 1 (unchanged)

  Ran on Windows 11 (build 26200) under Windows PowerShell 5.1.26100 and PowerShell 7.6.7, with identical results.
  Native Windows run: the unmodified install.ps1, no path shim, with a throwaway --dir= and LOCALAPPDATA; no install directory was written in any case.

• Still passing: test_release_archive_extractor_contract.sh, test_setup_scripts_contract.sh, test_release_gate_chain_contract.sh.

• install.ps1 is still pure ASCII (PS 5.1 requirement).

On the CI release-contract check I proposed in #1218: it's already covered by test_windows_bundle_contract.sh and test_release_archive_extractor_contract.sh (single-sourced four-file allowlist, fail-closed on surplus or missing members). So this PR doesn't add one.

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[DeusData]

Thank you, @RithvikReddy0-0, for carrying this all the way from your diagnosis on #1218 to a fix. Telling a checksum-verified layout mismatch apart from a genuinely unsafe archive is exactly the follow-up we hoped for, and you kept everything fail-closed: same allowlist, same checksum gate, same exit code. The part we appreciate most is the ordering: every entry is screened for unsafe paths and duplicates before any layout verdict, so a hostile entry can never hide behind the friendlier message. The contract assertions and your runs on both PowerShell versions made this easy to review. Merged, thank you!