[linghengqian]

vfox install java@25.0.2-graalce ends with WARNING: Checksum is not provided, skip verify..., and so does every other install: PreInstall never gave vfox a checksum (TODO: checksum in hooks/pre_install.lua), so vfox trusted whatever it downloaded. Foojay lists one for most distributions. For GraalVM Community 25.0.2, checksum_type is sha256 and checksum_uri points to the vendor's .sha256 file, while the record's own checksum is empty, so the file has to be fetched. Vendors write these files in different ways.

Change

• lib/checksum.lua (new) takes the digest from Foojay's record first (Temurin, Zulu, Liberica ...) and fetches checksum_uri only where the record has none. It reads the digest alone, sha256sum's <digest> <name> and <digest> *<name>, BSD's MD5 (<name>) = <digest>, and listings of several files, where it takes the line of the package's file name. Only digests of the algorithm's length count, and they are lower-cased, as vfox compares the hex string as it stands.
• PreInstall hands the digest to vfox under the name of its algorithm (sha256, sha1, sha512 or md5). vfox prints Verifying checksum <digest>... and, before it unpacks anything, fails the install with Checksum error if the download does not match.
• A checksum file on GitHub goes through VFOX_JAVA_GITHUB_MIRROR, like the download.
• Where Foojay lists no checksum (Dragonwell, Bisheng, Trava, AdoptOpenJDK, OpenLogic, Gluon GraalVM, Corretto after 8 and older releases of several others), nothing changes: vfox warns and installs.
• Where Foojay lists one that the plugin cannot use (the file does not answer, holds no digest for the package, or the algorithm is one vfox cannot verify), the install goes on without it, as before, and the plugin prints why: Cannot verify the download: .... Failing there would stop installs that work today: from my machine, the checksum file of Microsoft's JDK 25.0.5 times out in the TLS handshake. A file that lists other packages only gives no digest either: Microsoft's file for its EA build of 11.0.14 for macOS names the GA build.
• Linux loong64 (Loongnix) is unchanged. Its archive has an .md5sum next to each tarball, which a later change could read.
• Tests: tests/checksum_test.lua (new, added to the Test workflow), 22 more cases in tests/pre_install_test.lua, and e2e assertions on Linux and Windows that the pinned release of each default distribution is verified (Verifying checksum <digest>..., no warning).
• Docs, English and Chinese: a "Checksums" section in foojay.md, and mirror.md, troubleshooting.md, development.md, e2e.md and changes.md (Unreleased).

Verification

In Docker (ubuntu:26.04, vfox 1.0.13):

• vfox install java@25.0.2-graalce: before, WARNING: Checksum is not provided, skip verify.... Now Verifying checksum e0be791c8fda4d03b6b0a0cb824fef3149736170057b3a515252b44419606af0... and no warning, through gh-proxy.org and straight from GitHub.
• Real downloads verified: Temurin 21.0.8 (sha256, in the record), Liberica 25.0.4 with JavaFX (sha1, in the record), JetBrains 21.0.5 (sha512, file with the name), OpenJDK 25.0.2 (sha256, file on jdk.java.net) and Tencent Kona 25.0.4 (md5, BSD form). Bisheng, for which Foojay has no checksum, installs as before.
• Against a local stand-in for the mirror: a matching .sha256 installs, a mismatching one fails with Checksum error and installs nothing, and a 404 or an HTML page prints Cannot verify the download: ... and installs.
• tests/e2e/linux with vfox 1.0.13 for open, tem, librca-fx, jb and graalce (linux/amd64): all pass, with the new assertions.
• The offline Lua tests, stylua --check ., lua-language-server --check . --checklevel=Warning, and go vet, gofmt and go test -short in tests/e2e pass.

Not run locally: the Windows and Linux arm64 e2e jobs, and the main channel of vfox. Foojay lists a checksum for the pinned release of each default distribution on each of those platforms (checked 2026-11-02).

Notes

• Through a mirror, a checksum file on GitHub comes through the mirror too, so the check catches a damaged download but not a mirror that serves a matching pair. The digest in Foojay's record does not come through the mirror. mirror.md says so.
• vfox reads the whole archive into memory before it hashes it, with or without a checksum: a 300 MB archive peaks at 320 MiB either way.