security(upgrade): harden self-update and installer verification

[ajianaz]

What

Hardens cora upgrade and install.sh: exact checksum matching, safe temp dir and extraction, bounded/time-limited downloads, and no silent checksum skip.

Why

Security review found several weak spots in the update path: substring checksum matching, a predictable /tmp/cora-update-{version} dir, full-archive unpack (symlink/hardlink entries), no timeouts or size caps, a single env var that silently disabled verification, and an installer that failed open when checksums were missing.

How

• parse_checksum: exact filename equality after trimming a leading * or ./ (no more contains).
• Temp dir via tempfile::tempdir() (random, 0700, cleaned on drop). tempfile moved from dev-dependencies to dependencies.
• New extract_binary: rejects any symlink/hardlink or unsafe-path entry, extracts only the single regular-file cora entry (size capped).
• HTTP clients: connect_timeout + timeout, streamed body with a hard size cap (256 MiB archive, 1 MiB checksums/API JSON), redirect(Policy::none()) for the /releases/latest Location probe, and release tags validated (vX.Y.Z..., safe chars) before being used in URLs.
• CORA_UPGRADE_SKIP_CHECKSUM now errors unless CORA_UPGRADE_I_UNDERSTAND=1 is also set; when both are set a loud warning is printed. Not removed.
• install.sh: verification is mandatory (missing checksums file or entry is fatal) unless CORA_SKIP_CHECKSUM=1; exact filename match; shasum -a 256 fallback; rejects symlink/hardlink entries; extracts only the binary entry.

Follow-up (not in this PR): signature verification (cosign/minisign) once there is key infrastructure.

Testing

• cargo test --features tree-sitter passes
• cargo fmt --all -- --check passes
• cargo clippy --all-targets --features tree-sitter -- -D warnings passes
• cargo build --release --features tree-sitter passes (not run; local disk was full)
• Manual smoke-test: sh -n install.sh, awk checksum extraction checked against *name and .sig lines

New unit tests: exact checksum matching, skip-checksum gating, tag validation, tar extraction (regular file only, symlink/hardlink rejection, symlink named cora, missing binary). Network paths are not unit tested.

Related Issues

None.

Checklist

• Branch name follows convention (security/)
• Branch is from develop
• Commit messages follow Conventional Commits
• No secrets or credentials committed
• One logical change per PR (no mixed concerns)

🤖 Generated with Claude Code