From 29ca80aa05beea4b6e931cc4e79f8c00e2a56058 Mon Sep 17 00:00:00 2001
From: Alex Waygood <alex.waygood@gmail.com>
Date: Wed, 21 Oct 2026 13:32:15 -0700
Subject: [PATCH] Update sha2 to 0.11.1

---
 Cargo.lock     | 23 +++++++++++++++------
 Cargo.toml     |  2 +-
 src/release.rs | 54 +++++++++++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 71 insertions(+), 8 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a4f15bf2a..ff41e6248 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -656,7 +656,7 @@ dependencies = [
  "curve25519-dalek",
  "ed25519",
  "serde",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
@@ -1462,7 +1462,7 @@ dependencies = [
  "rsa",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "signature",
  "simple_asn1",
 ]
@@ -1562,7 +1562,7 @@ version = "0.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47bb1e988e6fb779cf720ad431242d3f03167c1b3f2b1aae7f1a94b2495b36ae"
 dependencies = [
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -1740,7 +1740,7 @@ dependencies = [
  "ecdsa",
  "elliptic-curve",
  "primeorder",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -1752,7 +1752,7 @@ dependencies = [
  "ecdsa",
  "elliptic-curve",
  "primeorder",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -1989,7 +1989,7 @@ dependencies = [
  "semver",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.11.1",
  "tar",
  "tempfile",
  "text-stub-library",
@@ -2668,6 +2668,17 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
diff --git a/Cargo.toml b/Cargo.toml
index 863f8af7d..f2438b274 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -27,7 +27,7 @@ rustls = { version = "0.23", default-features = false, features = ["ring"] }
 semver = "1.0.27"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.145"
-sha2 = "0.10.9"
+sha2 = "0.11.1"
 tar = "0.4.45"
 tempfile = "3.23.0"
 text-stub-library = "0.9.0"
diff --git a/src/release.rs b/src/release.rs
index e92c73b65..2f234c1e6 100644
--- a/src/release.rs
+++ b/src/release.rs
@@ -756,6 +756,49 @@ mod tests {
         assert!(!should_strip(Path::new("tcl90.dll"), &unsigned));
         assert!(!should_strip(Path::new("tcl9tk90.dll"), &unsigned));
     }
+
+    #[test]
+    fn verifies_and_rewinds_llvm_archive() -> Result<()> {
+        let contents = vec![b'x'; 20_000];
+        let mut file = tempfile::tempfile()?;
+        file.write_all(&contents)?;
+        file.rewind()?;
+        let download = Download {
+            url: String::new(),
+            size: contents.len() as u64,
+            sha256: "42e8bc96b8eec8c4e5d503483ba0cb843ce95243c8ca8575ffc69cd25d12c61c".to_string(),
+        };
+
+        let mut file = verify_llvm_archive(file, &download)?;
+        let mut actual = Vec::new();
+        file.read_to_end(&mut actual)?;
+        assert_eq!(actual, contents);
+        Ok(())
+    }
+
+    #[test]
+    fn rejects_invalid_llvm_archive_size_or_digest() -> Result<()> {
+        let mut file = tempfile::tempfile()?;
+        file.write_all(b"abc")?;
+        file.rewind()?;
+        let mut download = Download {
+            url: String::new(),
+            size: 4,
+            sha256: String::new(),
+        };
+
+        assert!(
+            verify_llvm_archive(file.try_clone()?, &download)
+                .is_err_and(|error| error.to_string().contains("size mismatch"))
+        );
+
+        download.size = 3;
+        assert!(
+            verify_llvm_archive(file, &download)
+                .is_err_and(|error| error.to_string().contains("SHA-256 mismatch"))
+        );
+        Ok(())
+    }
 }
 
 /// Create an install-only .tar.gz archive from a .tar.zst archive.
@@ -876,7 +919,16 @@ fn verify_llvm_archive(mut file: std::fs::File, download: &Download) -> Result<s
     );
 
     let mut hasher = Sha256::new();
-    std::io::copy(&mut file, &mut hasher)?;
+    let mut buffer = [0; 8192];
+    loop {
+        let count = match file.read(&mut buffer) {
+            Ok(0) => break,
+            Ok(count) => count,
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => continue,
+            Err(error) => return Err(error.into()),
+        };
+        hasher.update(&buffer[..count]);
+    }
     let sha256 = hex::encode(hasher.finalize());
     ensure!(
         sha256 == download.sha256,