[jessevz]

Files carried no content integrity information: only their size was recorded, and the agent can therefore verify a download by length alone. A wordlist whose bytes changed at the same length is indistinguishable from an intact one, and a corrupted or truncated-then-padded transfer is accepted. The TUS upload checksums are per chunk and discarded, so they never describe the assembled file.

File now carries a BLAKE3 checksum of its content, computed off-request by a background job and advertised on download as a RFC 9530 Repr-Digest header.

• File.checksum holds the digest as 64 lowercase hex characters, null until computed. It is cleared whenever the bytes on disk change, so a stale digest is never served, and deliberately kept across a rename, which moves the same bytes to a new name.
• ChecksumFileJob does the hashing through the background job runner, as a 100 GB wordlist cannot be hashed inside a request. Note that the runner processes jobs one at a time under a global lock, so a large file delays other jobs for its duration.
• Jobs are enqueued when a file is created, deduplicated against work already queued, and withdrawn again when the file is deleted. A global rescan backfills files without a checksum and re-queues any whose size no longer matches.
• GET /api/v2/helper/getFile and the legacy getFile.php both send Repr-Digest. It describes the representation rather than the message, so it is also sent on a 206, and it is added to Access-Control-Expose-Headers because the browser cannot read it otherwise.
• The agent protocol's getFile response gains a checksum field, which is additive: the existing agents deserialize without deny_unknown_fields and ignore it. It is null until the job ran, which an agent has to treat as "no checksum available".
• POST /api/v2/helper/recomputeFileChecksum re-queues a single file on demand.

BLAKE3 is absent from PHP's hash extension in every version, so the hashing shells out to b3sum, which the Dockerfile now installs. It is a hard requirement: when it is missing the job fails with that reason instead of leaving files silently unchecksummed.