From 5f68db89abd72b3b0fafbadf332421dcb0a2430f Mon Sep 17 00:00:00 2001
From: Pascal Birchler <pascalb@google.com>
Date: Mon, 3 Aug 2026 10:54:39 +0200
Subject: [PATCH] Add Behat scenarios testing SHA-512 enforcement and MD5
 handling during wp cli update

---
 features/cli.feature | 89 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 89 insertions(+)

diff --git a/features/cli.feature b/features/cli.feature
index a444c2c4c..4547b00c5 100644
--- a/features/cli.feature
+++ b/features/cli.feature
@@ -173,3 +173,92 @@ Feature: `wp cli` tasks
       """
       WP-CLI {UPDATE_VERSION}
       """
+
+  Scenario: Fail update when sha512 hash cannot be accessed
+    Given an empty directory
+    And a new Phar with version "2.8.0"
+    And that HTTP requests to https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli-nightly.phar.sha512 will respond with:
+      """
+      HTTP/1.1 404 Not Found
+      Content-Type: text/plain
+
+      Not Found
+      """
+
+    When I try `{PHAR_PATH} cli update --nightly --yes`
+    Then STDERR should contain:
+      """
+      Error: Couldn't access sha512 hash for release (HTTP code 404).
+      """
+    And the return code should be 1
+
+  Scenario: Fail update when sha512 hash mismatches
+    Given an empty directory
+    And a new Phar with version "2.8.0"
+    And that HTTP requests to https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli-nightly.phar.sha512 will respond with:
+      """
+      HTTP/1.1 200 OK
+      Content-Type: text/plain
+
+      invalidsha512hash
+      """
+
+    When I try `{PHAR_PATH} cli update --nightly --yes`
+    Then STDERR should contain:
+      """
+      Error: sha512 hash for download
+      """
+    And STDERR should contain:
+      """
+      is different than the release hash (invalidsha512hash).
+      """
+    And the return code should be 1
+
+  Scenario: Update succeeds when sha512 matches even if md5 cannot be accessed
+    Given an empty directory
+    And a new Phar with version "2.8.0"
+    And that HTTP requests to https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli-nightly.phar.md5 will respond with:
+      """
+      HTTP/1.1 404 Not Found
+      Content-Type: text/plain
+
+      Not Found
+      """
+
+    When I run `{PHAR_PATH} cli update --nightly --yes`
+    Then STDOUT should contain:
+      """
+      sha512 hash verified:
+      """
+    And STDOUT should contain:
+      """
+      Couldn't access md5 hash for release (HTTP code 404).
+      """
+    And STDOUT should contain:
+      """
+      Success: Updated WP-CLI to the latest nightly release.
+      """
+    And STDERR should be empty
+    And the return code should be 0
+
+  Scenario: Fail update when md5 hash mismatches
+    Given an empty directory
+    And a new Phar with version "2.8.0"
+    And that HTTP requests to https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli-nightly.phar.md5 will respond with:
+      """
+      HTTP/1.1 200 OK
+      Content-Type: text/plain
+
+      invalidmd5hash
+      """
+
+    When I try `{PHAR_PATH} cli update --nightly --yes`
+    Then STDERR should contain:
+      """
+      Error: md5 hash for download
+      """
+    And STDERR should contain:
+      """
+      is different than the release hash (invalidmd5hash).
+      """
+    And the return code should be 1