From 1909401fd9a3e56244cef46eb672bd417f136fef Mon Sep 17 00:00:00 2001
From: Chris Conlon <chris@wolfssl.com>
Date: Fri, 21 Aug 2026 16:20:51 -0600
Subject: [PATCH] F-3763: fail closed when no SHA-256 tool is available in
 CryptoBenchmark.sh

---
 examples/provider/CryptoBenchmark.sh | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/examples/provider/CryptoBenchmark.sh b/examples/provider/CryptoBenchmark.sh
index 1b66336e..845896b7 100755
--- a/examples/provider/CryptoBenchmark.sh
+++ b/examples/provider/CryptoBenchmark.sh
@@ -20,8 +20,9 @@ verify_sha256() {
   elif command -v shasum >/dev/null; then
     actual=$(shasum -a 256 "$file" | awk '{print $1}')
   else
-    echo "Warning: no sha256sum or shasum available, skipping hash verification"
-    return 0
+    echo "Error: no sha256sum or shasum found, refusing unverified $file"
+    rm -f "$file"
+    return 1
   fi
 
   if [ "$actual" != "$expected" ]; then
@@ -40,6 +41,13 @@ download_bc_jars() {
   local lib_dir="$LIB_DIR"
   local bc_url="https://repo1.maven.org/maven2/org/bouncycastle"
 
+  # Require a SHA-256 tool before any download, JARs are only added to the
+  # classpath after hash verification
+  if ! command -v sha256sum >/dev/null && ! command -v shasum >/dev/null; then
+    echo "failed (no sha256sum or shasum for hash verification)"
+    return 1
+  fi
+
   echo -n "Downloading Bouncy Castle JARs (version $bc_version)... "
   mkdir -p "$lib_dir" || {
     echo "failed (cannot create $lib_dir)"