From 48f01ba146ae0751f342695957d46698397e84c4 Mon Sep 17 00:00:00 2001
From: zarzet <zarzet@users.noreply.github.com>
Date: Sun, 26 Jul 2026 12:29:28 +0700
Subject: [PATCH] fix(extensions): isolate invalid registry checksums

---
 go_backend/extension_package_security_test.go | 25 +++++++++++--------
 go_backend/extension_repo.go                  | 10 ++++++--
 2 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/go_backend/extension_package_security_test.go b/go_backend/extension_package_security_test.go
index de741415..93cb6f6b 100644
--- a/go_backend/extension_package_security_test.go
+++ b/go_backend/extension_package_security_test.go
@@ -53,22 +53,25 @@ func TestWriteVerifiedExtensionPackageRejectsMismatchBeforeReplace(t *testing.T)
 	}
 }
 
-func TestRegistryRejectsMalformedExtensionChecksum(t *testing.T) {
-	_, err := parseRegistryBody([]byte(
-		`{"version":1,"extensions":[{"id":"ext","name":"ext","version":"1.0.0","sha256":"not-a-hash"}]}`,
-	))
-	if err == nil || !strings.Contains(err.Error(), "invalid SHA-256") {
-		t.Fatalf("expected invalid checksum error, got %v", err)
-	}
-
+func TestRegistrySkipsOnlyExtensionWithMalformedChecksum(t *testing.T) {
 	checksum := strings.Repeat("a", sha256.Size*2)
 	registry, err := parseRegistryBody([]byte(
-		`{"version":1,"extensions":[{"id":"ext","name":"ext","version":"1.0.0","checksumSha256":"sha256:` +
+		`{"version":1,"extensions":[` +
+			`{"id":"bad","name":"bad","version":"1.0.0","sha256":"not-a-hash"},` +
+			`{"id":"verified","name":"verified","version":"1.0.0","checksumSha256":"sha256:` +
 			checksum +
-			`"}]}`,
+			`"},` +
+			`{"id":"legacy","name":"legacy","version":"1.0.0"}` +
+			`]}`,
 	))
 	if err != nil {
-		t.Fatalf("parse registry with checksum alias: %v", err)
+		t.Fatalf("parse registry: %v", err)
+	}
+	if len(registry.Extensions) != 2 {
+		t.Fatalf("registry extensions = %#v, want valid entries only", registry.Extensions)
+	}
+	if registry.Extensions[0].ID != "verified" || registry.Extensions[1].ID != "legacy" {
+		t.Fatalf("registry extension order = %#v", registry.Extensions)
 	}
 	if got := registry.Extensions[0].getSHA256(); got != checksum {
 		t.Fatalf("normalized checksum = %q, want %q", got, checksum)
diff --git a/go_backend/extension_repo.go b/go_backend/extension_repo.go
index 0f1e7688..5b5633d6 100644
--- a/go_backend/extension_repo.go
+++ b/go_backend/extension_repo.go
@@ -331,16 +331,22 @@ func parseRegistryBody(body []byte) (*repoRegistry, error) {
 		}
 		return nil, fmt.Errorf("failed to parse registry: %w", err)
 	}
+	validExtensions := make([]repoExtension, 0, len(registry.Extensions))
 	for index := range registry.Extensions {
 		ext := &registry.Extensions[index]
 		rawChecksum := ext.getRawSHA256()
 		if rawChecksum != "" && normalizeSHA256(rawChecksum) == "" {
-			return nil, fmt.Errorf(
-				"extension %q has an invalid SHA-256 checksum",
+			LogWarn(
+				"ExtensionRepo",
+				"Skipping registry extension %q at index %d: invalid SHA-256 checksum",
 				ext.ID,
+				index,
 			)
+			continue
 		}
+		validExtensions = append(validExtensions, *ext)
 	}
+	registry.Extensions = validExtensions
 	return &registry, nil
 }