feat: a download that does not match the pin is refused

The bytes would sit under their own digest, where a later pin on that
digest would find them without ever asking for them.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: karo <karolin.kostial@gmail.com>

Author: The127

internal/download/pinned.go

@@ -2,6 +2,7 @@ package download
 
 import (
 	"context"
+	"fmt"
 	"os"
 )
 
@@ -13,9 +14,18 @@ func (s *Store) Pinned(ctx context.Context, url, digest string) (string, error)
 		return path, nil
 	}
 
-	if _, err := s.Get(ctx, url); err != nil {
+	got, err := s.Get(ctx, url)
+	if err != nil {
 		return "", err
 	}
 
+	if got != digest {
+		// the bytes would sit under their own digest, where a pin on that
+		// digest would later find them without ever asking for them
+		_ = os.Remove(s.Path(got))
+
+		return "", fmt.Errorf("GET %s: pinned to %s, downloaded %s", url, digest, got)
+	}
+
 	return path, nil
 }

internal/download/pinned_test.go

@@ -28,6 +28,15 @@ func kept(t *testing.T, dir, content string) string {
 	return "sha256:" + hash
 }
 
+// arrived is the digest bytes would have when they arrive.
+func arrived(t *testing.T, content string) string {
+	t.Helper()
+
+	sum := sha256.Sum256([]byte(content))
+
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
 func read(t *testing.T, path string) string {
 	t.Helper()
 
@@ -73,3 +82,22 @@ func TestAPinnedFileThatIsNotThereIsDownloadedAndKept(t *testing.T) {
 	assert.Equal(t, "the kernel", read(t, path))
 	assert.Equal(t, store.Path(digest), path)
 }
+
+func TestADownloadThatDoesNotMatchThePinIsRefused(t *testing.T) {
+	// arrange
+	server := serving(t, map[string]string{"/kernel.deb": "another kernel"})
+	dir := t.TempDir()
+	store := download.Open(dir, server.Client())
+	digest := arrived(t, "the kernel")
+
+	// act
+	_, err := store.Pinned(context.Background(), server.URL+"/kernel.deb", digest)
+
+	// assert
+	require.Error(t, err)
+	assert.ErrorContains(t, err, server.URL+"/kernel.deb")
+	assert.ErrorContains(t, err, digest)
+	assert.ErrorContains(t, err, arrived(t, "another kernel"))
+	kept, _ := filepath.Glob(filepath.Join(dir, "sha256", "*"))
+	assert.Empty(t, kept)
+}