fix: nil pointer dereference when CheckSumItem is absent (#599)

* Initial plan

* Fix nil pointer dereference when installing packages without checksums

Co-authored-by: aooohan <40265686+aooohan@users.noreply.github.com>

* Fix complete with tests and validation

Co-authored-by: aooohan <40265686+aooohan@users.noreply.github.com>

* Remove accidentally committed binary and update gitignore

Co-authored-by: aooohan <40265686+aooohan@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: aooohan <40265686+aooohan@users.noreply.github.com>

Author: Copilot

.gitignore

@@ -9,4 +9,4 @@ coverage.out
 **/available.cache
 **/.available.cache
 
-.vfox
+.vfox/vfox

go.mod

@@ -5,6 +5,8 @@ go 1.24.0
 require (
 	atomicgo.dev/cursor v0.2.0
 	atomicgo.dev/keyboard v0.2.9
+	github.com/BurntSushi/toml v1.6.0
+	github.com/Microsoft/go-winio v0.6.2
 	github.com/PuerkitoBio/goquery v1.9.3
 	github.com/bodgit/sevenzip v1.5.1
 	github.com/lithammer/fuzzysearch v1.1.8
@@ -15,15 +17,14 @@ require (
 	github.com/urfave/cli/v3 v3.4.1
 	github.com/yuin/gopher-lua v1.1.1
 	golang.org/x/crypto v0.35.0
+	golang.org/x/sync v0.19.0
 	golang.org/x/sys v0.30.0
 	golang.org/x/term v0.29.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	atomicgo.dev/schedule v0.1.0 // indirect
-	github.com/BurntSushi/toml v1.6.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/andybalholm/brotli v1.1.0 // indirect
 	github.com/andybalholm/cascadia v1.3.2 // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
@@ -48,6 +49,5 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go4.org v0.0.0-20200411211856-f5505b9728dd // indirect
 	golang.org/x/net v0.29.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/text v0.22.0 // indirect
 )

go.sum

@@ -267,8 +267,6 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

internal/plugin/model.go

@@ -36,6 +36,14 @@ func (p *PreInstallPackageItem) Label() string {
 	return p.Name + "@" + p.Version
 }
 
+// Checksum returns the checksum for this package, or NoneChecksum if no checksum is provided
+func (p *PreInstallPackageItem) Checksum() *shared.Checksum {
+	if p.CheckSumItem == nil {
+		return shared.NoneChecksum
+	}
+	return p.CheckSumItem.Checksum()
+}
+
 type CheckSumItem struct {
 	Sha256 string `json:"sha256"`
 	Sha512 string `json:"sha512"`

internal/plugin/model_test.go

@@ -0,0 +1,92 @@
+package plugin
+
+import (
+	"testing"
+
+	"github.com/version-fox/vfox/internal/shared"
+)
+
+func TestPreInstallPackageItem_Checksum(t *testing.T) {
+	t.Run("Returns NoneChecksum when CheckSumItem is nil", func(t *testing.T) {
+		// This is the case that was causing the nil pointer dereference
+		item := &PreInstallPackageItem{
+			Name:         "test-sdk",
+			Version:      "1.0.0",
+			Path:         "https://example.com/test.tar.gz",
+			CheckSumItem: nil, // Explicitly nil
+		}
+
+		checksum := item.Checksum()
+
+		if checksum != shared.NoneChecksum {
+			t.Errorf("Expected NoneChecksum, got %v", checksum)
+		}
+
+		if checksum.Type != "none" {
+			t.Errorf("Expected checksum type 'none', got '%s'", checksum.Type)
+		}
+
+		if checksum.Value != "" {
+			t.Errorf("Expected empty checksum value, got '%s'", checksum.Value)
+		}
+	})
+
+	t.Run("Returns checksum when CheckSumItem has sha256", func(t *testing.T) {
+		item := &PreInstallPackageItem{
+			Name:    "test-sdk",
+			Version: "1.0.0",
+			Path:    "https://example.com/test.tar.gz",
+			CheckSumItem: &CheckSumItem{
+				Sha256: "abc123def456",
+			},
+		}
+
+		checksum := item.Checksum()
+
+		if checksum.Type != "sha256" {
+			t.Errorf("Expected checksum type 'sha256', got '%s'", checksum.Type)
+		}
+
+		if checksum.Value != "abc123def456" {
+			t.Errorf("Expected checksum value 'abc123def456', got '%s'", checksum.Value)
+		}
+	})
+
+	t.Run("Returns checksum when CheckSumItem has md5", func(t *testing.T) {
+		item := &PreInstallPackageItem{
+			Name:    "test-sdk",
+			Version: "1.0.0",
+			Path:    "https://example.com/test.tar.gz",
+			CheckSumItem: &CheckSumItem{
+				Md5: "xyz789",
+			},
+		}
+
+		checksum := item.Checksum()
+
+		if checksum.Type != "md5" {
+			t.Errorf("Expected checksum type 'md5', got '%s'", checksum.Type)
+		}
+
+		if checksum.Value != "xyz789" {
+			t.Errorf("Expected checksum value 'xyz789', got '%s'", checksum.Value)
+		}
+	})
+
+	t.Run("Returns NoneChecksum when CheckSumItem has no checksums", func(t *testing.T) {
+		item := &PreInstallPackageItem{
+			Name:    "test-sdk",
+			Version: "1.0.0",
+			Path:    "https://example.com/test.tar.gz",
+			CheckSumItem: &CheckSumItem{
+				// All fields empty
+			},
+		}
+
+		checksum := item.Checksum()
+
+		if checksum != shared.NoneChecksum {
+			t.Errorf("Expected NoneChecksum when all checksum fields are empty, got %v", checksum)
+		}
+	})
+}