feat: update package dependencies and enhance checksum verification with b2 and b2sum support

src/package/interactive.rs

@@ -217,7 +217,7 @@ fn prompt_manual_sources() -> Result<Vec<ManualSource>> {
         if single_entry {
             let checksum = prompt_optional_text(
                 "Manual source checksum (optional):",
-                "sha256:/sha512:/md5:, raw SHA256 hex, or 'skip' (empty omits field)",
+                "sha256:/sha512:/md5:/b2:/b2sum:, raw SHA256 hex, or 'skip' (empty omits field)",
             )?;
             if !checksum.is_empty() {
                 manual.sha256 = Some(checksum);
@@ -411,7 +411,7 @@ pub fn create_interactive() -> Result<PackageSpec> {
 
             let source_sha256 = Text::new("Source checksum:")
                 .with_help_message(
-                    "Accepts sha256:, sha512:, md5:, or raw SHA256 hex (use 'skip' to bypass)",
+                    "Accepts sha256:, sha512:, md5:, b2:, b2sum:, or raw SHA256 hex (use 'skip' to bypass)",
                 )
                 .with_default(computed_sha_default.as_str())
                 .prompt()?;

src/package/spec.rs

@@ -3078,7 +3078,7 @@ pub struct Alternatives {
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
 pub struct Source {
     pub url: String,
-    /// Checksum for the source (e.g. `sha256:...`, `sha512:...`, `md5:...`, or raw SHA256 hex).
+    /// Checksum for the source (e.g. `sha256:...`, `sha512:...`, `md5:...`, `b2:...`, `b2sum:...`, or raw SHA256 hex).
     /// Defaults to `skip` when omitted.
     #[serde(default = "default_source_sha256")]
     pub sha256: String,

src/source/fetcher.rs

@@ -290,6 +290,7 @@ pub fn fetch_archive(spec: &PackageSpec, source: &Source, cache_dir: &Path) -> R
 /// - `sha256:<hex>` (or just `<hex>` — default)
 /// - `sha512:<hex>`
 /// - `md5:<hex>`
+/// - `b2:<hex>` / `b2sum:<hex>`
 /// - `skip` to bypass verification
 fn verify_checksum(path: &Path, expected: &str) -> Result<bool> {
     // Delegate to the shared checker in the parent `source` module.
@@ -731,7 +732,7 @@ mod tests {
     }
 
     #[test]
-    fn verify_checksum_accepts_md5_sha512_and_default_sha256() {
+    fn verify_checksum_accepts_md5_sha512_b2sum_and_default_sha256() {
         use sha2::Digest;
         use sha2::Sha256;
         use sha2::Sha512;
@@ -753,6 +754,9 @@ mod tests {
         };
 
         let md5_hex = format!("{:x}", md5::compute(b"abc"));
+        let b2_hex = b2sum_rust::Blake2bSum::new(64)
+            .read(tmp.path())
+            .to_ascii_lowercase();
 
         // unprefixed should default to sha256
         assert!(verify_checksum(tmp.path(), &sha256_hex).unwrap());
@@ -760,6 +764,8 @@ mod tests {
         assert!(verify_checksum(tmp.path(), &format!("sha256:{}", sha256_hex)).unwrap());
         assert!(verify_checksum(tmp.path(), &format!("sha512:{}", sha512_hex)).unwrap());
         assert!(verify_checksum(tmp.path(), &format!("md5:{}", md5_hex)).unwrap());
+        assert!(verify_checksum(tmp.path(), &format!("b2:{}", b2_hex)).unwrap());
+        assert!(verify_checksum(tmp.path(), &format!("b2sum:{}", b2_hex)).unwrap());
         // empty algorithm before colon -> assume sha256
         assert!(verify_checksum(tmp.path(), &format!(":{}", sha256_hex)).unwrap());
         // negative: wrong value fails

src/source/mod.rs

@@ -181,7 +181,8 @@ fn copy_manual_source_file(
 
 /// Verify a file against an `expected` checksum string.
 ///
-/// Formats accepted: `sha256:HEX`, `sha512:HEX`, `md5:HEX`, or plain `HEX` (assumed sha256).
+/// Formats accepted: `sha256:HEX`, `sha512:HEX`, `md5:HEX`, `b2:HEX`,
+/// `b2sum:HEX`, or plain `HEX` (assumed sha256).
 fn verify_file_hash(path: &Path, expected: &str) -> Result<bool> {
     use anyhow::bail;
     use std::io::Read;
@@ -251,6 +252,10 @@ fn verify_file_hash(path: &Path, expected: &str) -> Result<bool> {
             let actual = format!("{:x}", digest);
             Ok(actual == hex)
         }
+        "b2" | "b2sum" => {
+            let actual = b2sum_rust::Blake2bSum::new(64).read(path);
+            Ok(actual.eq_ignore_ascii_case(&hex))
+        }
         _ => bail!("Unsupported checksum algorithm: {}", alg),
     }
 }
@@ -716,11 +721,16 @@ mod tests {
             format!("{:x}", h.finalize())
         };
         let md5_hex = format!("{:x}", md5::compute(b"abc"));
+        let b2_hex = b2sum_rust::Blake2bSum::new(64)
+            .read(tmp.path())
+            .to_ascii_lowercase();
 
         assert!(verify_file_hash(tmp.path(), &sha256_hex).unwrap());
         assert!(verify_file_hash(tmp.path(), &format!("sha256:{}", sha256_hex)).unwrap());
         assert!(verify_file_hash(tmp.path(), &format!("sha512:{}", sha512_hex)).unwrap());
         assert!(verify_file_hash(tmp.path(), &format!("md5:{}", md5_hex)).unwrap());
+        assert!(verify_file_hash(tmp.path(), &format!("b2:{}", b2_hex)).unwrap());
+        assert!(verify_file_hash(tmp.path(), &format!("b2sum:{}", b2_hex)).unwrap());
         assert!(verify_file_hash(tmp.path(), &format!(":{}", sha256_hex)).unwrap());
         assert!(!verify_file_hash(tmp.path(), "md5:deadbeef").unwrap());
     }