fix(arcup): accept a checksum file with no trailing newline

[erkancamli]

Reopened from #402 so that every commit carries a verified signature. #402's first two commits were pushed unsigned, and this repo requires verified signatures to merge, so that branch could not be fixed in place. The change is identical; the two files are byte for byte what #402 ended with.

What is wrong

verify_checksum_file decides whether the checksum file is empty from the exit status of read (arcup/arcup:659 on main):

if ! read -r expected_checksum expected_name < "$checksum_path"; then
    error "Checksum file is empty: $checksum_path"

read returns non-zero at EOF even when it populated the variables, which is exactly what happens for a single line with no trailing newline. On bash 5.2.21:

$ printf 'abc  name' > nl.txt
$ if ! read -r a b < nl.txt; then echo "READ FAILED, a=[$a] b=[$b]"; fi
READ FAILED, a=[abc] b=[name]

So a valid checksum file is rejected as empty, and the operator is told the file is empty when it is not.

The fix

Inspect the parsed value rather than the exit status. Also guards an unreadable or missing checksum path, which previously leaked a raw redirection error and then aborted on an unbound variable under set -u:

arcup/arcup: line 662: /tmp/.../absent.sha256: No such file or directory
arcup/arcup: line 664: expected_checksum: unbound variable

ARCUP_INSTALLER_VERSION goes to 0.2.1, as the header comment at arcup/arcup:7-8 requires. self_update gates on version_gt "$remote_version" "$ARCUP_INSTALLER_VERSION" (lines 423 and 452), so leaving it at 0.2.0 would make every existing install answer "Arcup is already up to date" and never pick the fix up.

Reachability, stated plainly

No official release can trigger this. scripts/release-package.sh:31-34 writes the checksum with sha256sum or shasum -a 256, both of which always emit a trailing newline, and arcup has no offline install mode. The reachable cases are ARC_REPO pointing at a third-party release, or a mirror serving its own assets through GITHUB_API_URL.

On the official path the user-visible win is the second half: an unreadable or missing checksum file now produces one clear message instead of two confusing ones.

Tests

Five cases in arcup/test_arcup.sh: no trailing newline, a bare checksum with neither filename nor newline, an empty file, a blank first line, and a missing file. 30/30 pass on bash 5.2.21.

The three failing cases assert the message, not just a non-zero exit. That matters: all three also fail on main, for the wrong reasons, so without the message assertion they would be characterization tests and the new -r guard would have no coverage at all. Removing only that guard makes the missing-file case fail with the raw bash error above, which is what it prevents.

shellcheck -S style reports the same three pre-existing SC2030/SC2031 infos as main, nothing new. Note that arcup/test_arcup.sh is not wired into any workflow; I ran it by hand.

Happy to split the unreadable-file guard into its own PR if you would rather keep this one to the newline change.

[github-actions]

Hi @erkancamli,

Thank you for your interest in contributing to Arc Node.

This PR has been automatically closed because it does not reference a GitHub issue. All PRs must reference an existing issue using the format Closes: #XXX.

To contribute properly:

1. Find an existing issue you'd like to work on, or open a new issue describing your proposed change
2. Comment on the issue requesting assignment and wait for maintainer approval
3. Only submit a PR after you have been assigned to the issue

Please see our CONTRIBUTING.md for more details.