[Feature Request] Compare hash after download

[hazre]

requested by ljoonal#2847 in NML discord.

[l-2-j]

Yup, the manifest design docs outlines the basic goals & security concerns with the manifest, and the most relevant to installer/updater tools is:

Github artifacts are NOT immutable, meaning a fixed URL does not guarantee a fixed file. Therefore we MUST verify artifacts clientside.

Whilst it's not really a concern with just listing the mods, providing an easy to use way to install them whilst not verifying that the hashes match fully voids the modding community auditing process. I feel like it should be at least stated if not fixed, since this might give users a false sense of security with the way that neosmodloader.com is linked to, since the landing page states that:

The mod list is a community-managed listing of mods that are vetted to not be malicious.
The purpose of the list is to make it easier & safer for people to run mods. Since mods are another form of executables, and it’s generally not recommended to not run random executables from the internet.

[hazre]

Notes to myself:

Possible ways of displaying a user prompt when hashes don't match:

• Window.confirm() (Vanilla API but ugly)
• Svelte Component API (Customizable but requires a refactor of download function)