Three gaps allowed an unverified binary to reach a trusted location:
- The ffmpeg ZIP fallback logged a warning on checksum mismatch and
installed anyway (the 7z path already aborted). Abort instead.
- The yt-dlp auto-update path downloaded and renamed the binary over
the verified one with no checksum at all. Verify against the official
SHA2-256SUMS like the first-install path, and use atomic os.replace.
- The yt-dlp first install streamed the download directly to the
trusted path and only verified afterwards; a crash in between left an
unverified executable to be run on next launch. Download to .part and
os.replace only after verification.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
setx truncates values at 1024 characters, and the old code fed it the
merged process PATH (system + user), permanently duplicating every
system entry into the user hive and silently dropping anything past the
limit. Read and rewrite only the HKCU Environment Path value with
winreg, preserving REG_EXPAND_SZ, and broadcast WM_SETTINGCHANGE.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Renamed 'src/core' to 'ytsage/core' and updated all internal imports to use relative paths. This improves package structure and ensures correct module resolution after the directory move.
Jaroslav Beneš