check download file integrity

Author: srnagar

PluginsAndFeatures/azure-toolkit-for-intellij/azure-intellij-plugin-azuremcp/src/main/java/com/microsoft/azure/toolkit/intellij/azuremcp/AzureMcpPackageManager.java

@@ -2,9 +2,11 @@
 
 import com.intellij.openapi.application.PathManager;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.codec.digest.DigestUtils;
 import org.apache.commons.compress.archivers.tar.TarArchiveEntry;
 import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
 import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.SystemUtils;
 import org.jetbrains.annotations.NotNull;
 
@@ -59,7 +61,7 @@ public synchronized File getAzureMcpExecutable() {
                             final File azMcpTgz = new File(azMcpDir, "azmcp_" + tagName + ".tgz");
                             log.info("Downloading Azure MCP Server to: " + azMcpTgz.getAbsolutePath());
                             final boolean downloaded = gitHubClient.downloadToFile(asset.getBrowserDownloadUrl(), azMcpTgz);
-                            if (downloaded) {
+                            if (downloaded && digestMatches(azMcpTgz, asset.getDigest())) {
                                 log.info("Downloaded Azure MCP Server successfully in " + (System.currentTimeMillis() - startTime) + " ms");
                                 log.info("Extracting Azure MCP Server to: " + extractedDir.getAbsolutePath());
                                 extractTarGz(azMcpTgz, extractedDir);
@@ -80,6 +82,18 @@ public synchronized File getAzureMcpExecutable() {
         return null;
     }
 
+    private boolean digestMatches(File azMcpTgz, String expectedDigest) {
+        try {
+            // GitHub releases API computes the SHA-256 digest of the file contents.
+            // https://github.blog/changelog/2025-06-03-releases-now-expose-digests-for-release-assets/
+            final String downloadFileDigest = DigestUtils.sha256Hex(new FileInputStream(azMcpTgz));
+            return StringUtils.equalsIgnoreCase("sha256:" + downloadFileDigest, expectedDigest);
+        } catch (final Exception e) {
+            log.error("Failed to calculate file digest", e);
+            return false;
+        }
+    }
+
     public synchronized void cleanup() {
         try {
             final String azMcpDir = PathManager.getPluginsPath() + "/azure-toolkit-for-intellij/azmcp";