Verify testgen downloads against a SHA-512 asset table

releaseAsset now looks a build up in a table of version, platform, file
name and SHA-512, and Install hashes every byte off the wire, including
the tail of a tarball past the binary, and discards a download whose
digest does not match. A version missing from the table cannot be
installed. The tarball digests are the ones ClickHouse publishes in its
.sha512 sidecar files; the macOS binaries have no published digest, so
theirs were computed from the downloads.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y6XkyWnx7iJFEb8q3AnYps

Author: claude

internal/engine/clickhouse/testgen/README.md

@@ -16,9 +16,12 @@ go run . analyze --schema schema.sql --fixture fixture.sql query.sql
 ```
 
 The binary is looked up in the `CLICKHOUSE` environment variable first, then
-in the cache populated by `install`. The version is pinned in `install.go`;
-bumping it can change the query tree format and type inference, so regenerate
-and review the goldens afterwards.
+in the cache populated by `install`. The version is pinned in `install.go`,
+whose asset table lists each platform's download and its SHA-512; a download
+that does not match is discarded. Bumping the version means adding the new
+release's assets and checksums to the table, and since a release can change
+the query tree format and type inference, regenerating and reviewing the
+goldens afterwards.
 
 ## How it works
 

internal/engine/clickhouse/testgen/install.go

@@ -4,6 +4,8 @@ import (
 	"archive/tar"
 	"compress/gzip"
 	"context"
+	"crypto/sha512"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -17,9 +19,34 @@ import (
 // DefaultVersion is the ClickHouse release the goldens are generated with.
 // Bumping it is a deliberate change: the query tree format and type
 // inference can shift between releases, so regenerate and review the goldens
-// after changing it.
+// after changing it, and add the new release's assets to the table below.
 const DefaultVersion = "25.8.2.29"
 
+// asset is one downloadable build of ClickHouse. Linux builds are published
+// as clickhouse-common-static tarballs holding the binary at
+// usr/bin/clickhouse; macOS builds are published as bare binaries.
+type asset struct {
+	Version string
+	OS      string
+	Arch    string
+	Name    string
+	SHA512  string
+}
+
+// assets lists every build Install knows how to fetch, with the SHA-512 of
+// the download. A version that is not in this table cannot be installed:
+// verifying the download is the point of the table.
+//
+// The tarball checksums are the ones in the .sha512 files ClickHouse
+// publishes next to them. ClickHouse publishes no checksum for the macOS
+// binaries, so those were computed from the downloads.
+var assets = []asset{
+	{"25.8.2.29", "linux", "amd64", "clickhouse-common-static-25.8.2.29-amd64.tgz", "6ff0aa1ffac6e564970174422ecde0d645cdb96812247a6e544d39cad6d78a514265f90a2bc7b4bad49903cea96eddd16a415a45b2aeaf9164461be76331bdee"},
+	{"25.8.2.29", "linux", "arm64", "clickhouse-common-static-25.8.2.29-arm64.tgz", "68204ca4d4e472790f808ee376251fae82e58066a31f35a40d15d442ce5988d697f18a1208d28b8bb8e2dfad4b20b7fcb5107e2178472abcd97251b8de7f058e"},
+	{"25.8.2.29", "darwin", "amd64", "clickhouse-macos", "2805805ad2506e37a3e71b4ae9e797bdc010a9368dc28e99bcaaa2c70a72cfdd031c0fce8fc304248fad73211d28d645f75c6432cfae1e1e54d72d04e8626cd4"},
+	{"25.8.2.29", "darwin", "arm64", "clickhouse-macos-aarch64", "4c9237e85c8d4e1aced2b339b32e086b4f23fa14f99754b056a7e33dda88c4fb5d52e09e29d20181ec5b580caadb00f36613802e71755ff34927535eb8babf79"},
+}
+
 // releaseTag returns the GitHub release tag for a version. ClickHouse tags
 // its March and August releases as LTS and everything else as stable.
 func releaseTag(version string) (string, error) {
@@ -38,27 +65,33 @@ func releaseTag(version string) (string, error) {
 	return "v" + version + suffix, nil
 }
 
-// releaseAsset returns the download URL for a platform and whether it is a
-// tarball holding the binary at usr/bin/clickhouse rather than the bare
-// binary. Linux builds are only published as tarballs; macOS builds only as
-// bare binaries.
-func releaseAsset(version, goos, goarch string) (url string, tarball bool, err error) {
-	tag, err := releaseTag(version)
+// releaseAsset finds the build for a platform in the table.
+func releaseAsset(version, goos, goarch string) (asset, error) {
+	for _, a := range assets {
+		if a.Version == version && a.OS == goos && a.Arch == goarch {
+			return a, nil
+		}
+	}
+	for _, a := range assets {
+		if a.Version == version {
+			return asset{}, fmt.Errorf("no ClickHouse %s build is listed for %s/%s", version, goos, goarch)
+		}
+	}
+	return asset{}, fmt.Errorf("ClickHouse %s is not in the asset table; add its downloads and checksums to install.go", version)
+}
+
+// url is the asset's download address on GitHub.
+func (a asset) url() (string, error) {
+	tag, err := releaseTag(a.Version)
 	if err != nil {
-		return "", false, err
-	}
-	base := "https://github.com/ClickHouse/ClickHouse/releases/download/" + tag + "/"
-	switch goos + "/" + goarch {
-	case "linux/amd64":
-		return base + "clickhouse-common-static-" + version + "-amd64.tgz", true, nil
-	case "linux/arm64":
-		return base + "clickhouse-common-static-" + version + "-arm64.tgz", true, nil
-	case "darwin/amd64":
-		return base + "clickhouse-macos", false, nil
-	case "darwin/arm64":
-		return base + "clickhouse-macos-aarch64", false, nil
-	}
-	return "", false, fmt.Errorf("no ClickHouse build is published for %s/%s", goos, goarch)
+		return "", err
+	}
+	return "https://github.com/ClickHouse/ClickHouse/releases/download/" + tag + "/" + a.Name, nil
+}
+
+// tarball reports whether the download is an archive rather than the binary.
+func (a asset) tarball() bool {
+	return strings.HasSuffix(a.Name, ".tgz")
 }
 
 // cachedBinary is where Install puts the binary for a version.
@@ -87,7 +120,8 @@ func Locate() (string, error) {
 }
 
 // Install downloads the clickhouse binary for a version into the cache and
-// returns its path. It is a no-op when the version is already cached.
+// returns its path. It is a no-op when the version is already cached. The
+// download is checked against the table's SHA-512 before it is installed.
 func Install(ctx context.Context, version, goos, goarch string, progress io.Writer) (string, error) {
 	dest, err := cachedBinary(version)
 	if err != nil {
@@ -96,7 +130,11 @@ func Install(ctx context.Context, version, goos, goarch string, progress io.Writ
 	if _, err := os.Stat(dest); err == nil {
 		return dest, nil
 	}
-	url, tarball, err := releaseAsset(version, goos, goarch)
+	a, err := releaseAsset(version, goos, goarch)
+	if err != nil {
+		return "", err
+	}
+	url, err := a.url()
 	if err != nil {
 		return "", err
 	}
@@ -118,17 +156,21 @@ func Install(ctx context.Context, version, goos, goarch string, progress io.Writ
 		return "", fmt.Errorf("downloading %s: %s", url, resp.Status)
 	}
 
-	// Write next to the destination and rename so a partial download never
-	// masquerades as an installed binary.
+	// Write next to the destination and rename so a partial or corrupt
+	// download never masquerades as an installed binary.
 	tmp, err := os.CreateTemp(filepath.Dir(dest), "clickhouse-*.partial")
 	if err != nil {
 		return "", err
 	}
 	defer os.Remove(tmp.Name())
 
-	var src io.Reader = resp.Body
-	if tarball {
-		src, err = binaryInTarball(resp.Body)
+	// Hash every byte that comes off the wire, including the parts of a
+	// tarball after the binary, which extraction would otherwise not read.
+	sum := sha512.New()
+	body := io.TeeReader(resp.Body, sum)
+	var src io.Reader = body
+	if a.tarball() {
+		src, err = binaryInTarball(body)
 		if err != nil {
 			return "", fmt.Errorf("downloading %s: %w", url, err)
 		}
@@ -137,9 +179,16 @@ func Install(ctx context.Context, version, goos, goarch string, progress io.Writ
 		tmp.Close()
 		return "", err
 	}
+	if _, err := io.Copy(io.Discard, body); err != nil {
+		tmp.Close()
+		return "", err
+	}
 	if err := tmp.Close(); err != nil {
 		return "", err
 	}
+	if got := hex.EncodeToString(sum.Sum(nil)); got != a.SHA512 {
+		return "", fmt.Errorf("downloading %s: SHA-512 mismatch: got %s, want %s", url, got, a.SHA512)
+	}
 	if err := os.Chmod(tmp.Name(), 0o755); err != nil {
 		return "", err
 	}