⛄ Sync 2026-10-22 00:07:59

luci-app-passwall/Makefile

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall
 PKG_VERSION:=26.10.16
-PKG_RELEASE:=343
+PKG_RELEASE:=344
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall/luasrc/passwall/api.lua

@@ -277,6 +277,16 @@ function md5_string(str)
 	return md5
 end
 
+-- 校验文件 SHA256
+function verify_sha256(file, digest)
+	if type(digest) ~= "string" then return false end
+	local expected = digest:match("^sha256:(%x+)$")
+	if not expected or #expected ~= 64 then return false end
+	local code, output = exec_call("sha256sum " .. util.shellquote(file))
+	local actual = output:match("^(%x+)%s")
+	return code == 0 and actual ~= nil and actual:lower() == expected:lower()
+end
+
 --提取URL中的域名和端口(no ip)
 function get_domain_port_from_url(url)
 	local scheme, domain, port = string.match(url, "^(https?)://([%w%.%-]+):?(%d*)")
@@ -298,9 +308,14 @@ function resolve_domain(domain, dns)
 	address = (address or dns):gsub("^%[(.-)%]$", "%1")
 	port = port or "53"
 	local server = datatypes.ip6addr(address) and ("[" .. address .. "]") or address
+	local dns_servers = {server .. ":" .. port, address .. "#" .. port, "223.5.5.5"}
+	local version = sys.exec("LC_ALL=C busybox nslookup -v 2>&1"):match("BusyBox v(%d+%.%d+%.%d+)")
+	if version and compare_versions(version, "<", "1.35.0") then
+		dns_servers[1], dns_servers[2] = dns_servers[2], dns_servers[1]
+	end
 	local rc, result
-	for _, dns_server in ipairs({server .. ":" .. port, address .. "#" .. port, "223.5.5.5"}) do
-		rc, result = exec_call_as_gid("LC_ALL=C nslookup " .. util.shellquote(domain) .. " " .. util.shellquote(dns_server), DIRECT_GID)
+	for _, dns_server in ipairs(dns_servers) do
+		rc, result = exec_call_as_gid("LC_ALL=C busybox nslookup " .. util.shellquote(domain) .. " " .. util.shellquote(dns_server), DIRECT_GID)
 		local ips, seen, answer = {}, {}, false
 		for line in result:gmatch("[^\r\n]+") do
 			if line:match("^%s*Name:") then answer = true end
@@ -1212,6 +1227,17 @@ local function check_path(app_name)
 	}
 end
 
+local function cache_update_digests(app_name, assets)
+	local digests = {}
+	for _, asset in ipairs(assets) do
+		if asset.browser_download_url and type(asset.digest) == "string" then
+			digests[asset.browser_download_url] = asset.digest
+		end
+	end
+	fs.mkdirr(CACHE_PATH)
+	fs.writefile(CACHE_PATH .. "/update_" .. app_name .. ".json", jsonc.stringify(digests))
+end
+
 function to_check(arch, app_name)
 	local result = check_path(app_name)
 	if result.code ~= 0 then
@@ -1276,6 +1302,7 @@ function to_check(arch, app_name)
 		}
 	end
 
+	cache_update_digests(app_name, {asset})
 	return {
 		code = 0,
 		has_update = has_update,
@@ -1296,6 +1323,12 @@ function to_download(app_name, url, size, task_id, keep_files)
 		return {code = 1, error = i18n.translate("Download url is required.")}
 	end
 
+	local digests = jsonc.parse(fs.readfile(CACHE_PATH .. "/update_" .. app_name .. ".json") or "{}")
+	local digest = type(digests) == "table" and digests[url]
+	if type(digest) ~= "string" then
+		return {code = 1, error = i18n.translate("File verification failed.")}
+	end
+
 	if not keep_files then remove("/tmp/" .. app_name .. "_download.*") end
 
 	local tmp_file
@@ -1334,6 +1367,11 @@ function to_download(app_name, url, size, task_id, keep_files)
 		}
 	end
 
+	if not verify_sha256(tmp_file, digest) then
+		exec("/bin/rm", {"-f", tmp_file})
+		return {code = 1, error = i18n.translate("File verification failed.")}
+	end
+
 	return {code = 0, file = tmp_file, zip = com[app_name].zipped }
 end
 
@@ -1541,6 +1579,7 @@ function to_check_self()
 	if not main or not i18n_package then
 		return {code = 1, error = i18n.translate("Get remote version info failed.")}
 	end
+	cache_update_digests(appname, {main, i18n_package})
 	return {
 		code = 0, has_update = has_update, local_version = local_version,
 		remote_version = remote_version, html_url = release.html_url,

luci-app-passwall/luasrc/view/passwall/app_update/app_version.htm

@@ -86,7 +86,7 @@ local com = self.com
 		var app = btn.getAttribute('data-update-app');
 		var detailId = app === appname ? appname + '-check_btn' : '_' + app + '-check_btn';
 		var ckeckDetailElm = document.getElementById(detailId + '-detail');
-		if (app === appname && !checking) errorMessage = errorMessage ? updateFailedText : unknownErrorText;
+		if (app === appname && !checking && !errorMessage) errorMessage = unknownErrorText;
 		if (errorMessage && ckeckDetailElm) {
 			ckeckDetailElm.textContent = errorMessage
 		}

luci-app-passwall/po/zh-cn/passwall.po

@@ -1547,6 +1547,9 @@ msgstr "请指定下载地址。"
 msgid "File download failed or timed out: %s"
 msgstr "文件下载失败或超时：%s"
 
+msgid "File verification failed."
+msgstr "文件校验失败"
+
 msgid "File path required."
 msgstr "请指定文件路径。"
 

luci-app-passwall/root/usr/share/passwall/rule_update.lua

@@ -565,31 +565,25 @@ local function fetch_geofile(geo_name, geo_type, url)
 	local sha_url = url:gsub((down_filename:gsub("(%W)", "%%%1")), down_filename .. ".sha256sum")
 	local sha_path = tmp_path .. ".sha256sum"
 
-	local function verify_sha256(sha_file)
-		return sys.call("sha256sum -c " .. sha_file .. " > /dev/null 2>&1") == 0
-	end
-
+	local digest
 	local sha_verify = select(1, curl(sha_url, sha_path)) == 0
 	if sha_verify then
 		local f = io.open(sha_path, "r")
 		if f then
 			local content = f:read("*l")
 			f:close()
-			if content then
-				content = content:gsub("(%x+)%s+.+", "%1  " .. tmp_path)
-				f = io.open(sha_path, "w")
-				if f then
-					f:write(content)
-					f:close()
-				end
+			local hash = content and content:match("^(%x+)%s")
+			if hash and #hash == 64 then
+				digest = "sha256:" .. hash
 			end
 		end
-		if fs.access(asset_path) then
-			sys.call(string.format("cp -f %s %s", asset_path, tmp_path))
-			if verify_sha256(sha_path) then
-				log(geo_type .. " 版本一致，无需更新。")
-				return 0
-			end
+		if not digest then
+			log(geo_type .. " SHA256 校验信息无效，更新失败。")
+			return 1
+		end
+		if fs.access(asset_path) and api.verify_sha256(asset_path, digest) then
+			log(geo_type .. " 版本一致，无需更新。")
+			return 0
 		end
 	end
 
@@ -605,7 +599,7 @@ local function fetch_geofile(geo_name, geo_type, url)
 	end
 	if sret_tmp == 0 then
 		if sha_verify then
-			if verify_sha256(sha_path) then
+			if api.verify_sha256(tmp_path, digest) then
 				sys.call(string.format("mkdir -p %s && mv -f %s %s", backup_path, asset_path, backup_path))
 				sys.call(string.format("mkdir -p %s && mv -f %s %s", asset_location, tmp_path, asset_path))
 				reboot = 1