security(marketplace): require SHA256 checksum before HttpMarketplace install

[ZhuchkaTriplesix]

Summary

HttpMarketplaceRepository.install() verifies SHA256 only when manifest.sha256Checksum is present. If the field is missing or empty, the archive is extracted and registered without integrity verification.

This contradicts the updater model (AppUpdaterService refuses download without checksum) and will be exploitable once HttpMarketplaceRepository replaces the mock in production (0.5.0 Marketplace Launch).

Affected code

• lib/core/market/http_marketplace_repository.dart (lines 127–136)

Proposed fix

• Treat missing/empty sha256Checksum as a hard install failure for marketplace installs.
• Backend contract: MarketApi must always publish checksums for downloadable artifacts.
• Add tests: install aborts when checksum absent; install aborts on mismatch.

Acceptance criteria

• Marketplace install fails closed without a valid SHA256 in manifest.
• Error message is user-friendly (checksum missing vs mismatch).
• Unit tests cover both cases.

Severity

Medium — supply-chain / MITM on extension download when live API is enabled.

Related

• Security review 0.4.11
• Updater reference: lib/core/updater/app_updater_service.dart