feat(remote): Improve remote:curl checksum comparison failure reporting.

[Bill-hbrhbr]

Background

Currently, this task verified downloads using a diff <(...) <(...) checksum check, which showed intermittent failures on GitHub macOS runners. E.g.
https://github.com/y-scope/clp/actions/runs/23596584755/job/68714868001?pr=2093

From the logs, the failure is attributed to remote:curl at the end of execution:

#23622 2026-03-26T13:32:25.0267820Z ^[[31mtask: Failed to run task "deps:core": task: Failed to run task "deps:yscope-dev-utils:cmake:install-deps-and-generate-settings:/Users/runner/work/clp/clp/build/deps/cpp/cmake-settings-core-all-parallel": task: Failed to run task "deps:core-all-parallel": task: Failed to run task "deps:fmt": task: Failed to run task "deps:utils:install-remote-cmake-lib": task: Failed to run task "deps:utils:yscope-dev-utils:cmake:install-remote-tar:fmt-https://github.com/fmtlib/fmt/archive/refs/tags/11.2.0.tar.gz-/Users/runner/work/clp/clp/build/deps/cpp/fmt-install": task: Failed to run task "deps:utils:yscope-dev-utils:cmake:remote:download-and-extract-tar-/Users/runner/work/clp/clp/build/deps/cpp/fmt-extracted": task: Failed to run task "deps:utils:yscope-dev-utils:cmake:remote:curl-/Users/runner/work/clp/clp/build/deps/cpp/fmt-extracted.tar.gz": exit status 1
#23623 2026-03-26T13:32:25.0315570Z ##[error]task: Failed to run task "deps:yscope-dev-utils:cmake:install-deps-and-generate-settings:/Users/runner/work/clp/clp/build/deps/cpp/cmake-settings-core-all-parallel": task: Failed to run task "deps:core-all-parallel": task: Failed to run task "deps:fmt": task: Failed to run task "deps:utils:install-remote-cmake-lib": task: Failed to run task "deps:utils:yscope-dev-utils:cmake:install-remote-tar:fmt-https://github.com/fmtlib/fmt/archive/refs/tags/11.2.0.tar.gz-/Users/runner/work/clp/clp/build/deps/cpp/fmt-install": task: Failed to run task "deps:utils:yscope-dev-utils:cmake:remote:download-and-extract-tar-/Users/runner/work/clp/clp/build/deps/cpp/fmt-extracted": task: Failed to run task "deps:utils:yscope-dev-utils:cmake:remote:curl-/Users/runner/work/clp/clp/build/deps/cpp/fmt-extracted.tar.gz": exit status 1

However, remote:curl itself appears to run to completion, reaching the final checksum step:

#903 2026-03-26T13:24:10.3000380Z diff \
#904 2026-03-26T13:24:10.3108060Z   <(echo "bc23066d87ab3168f27cef3e97d545fa63314f5c79df5ea444d41d56f962c6af") \
#905 2026-03-26T13:24:10.3212480Z   <(openssl dgst -sha256 "/Users/runner/work/clp/clp/build/deps/cpp/fmt-extracted.tar.gz" | awk '{print $2}')

There is no clear indication of why the diff command failed. More broadly, these intermittent failures are difficult to interpret in interleaved logs produced by the parallel execution of deps:core tasks, where the task fails without clearly surfacing the root cause.

A different bug

https://github.com/y-scope/clp/actions/runs/23913577520/job/69741617703?pr=2170

deps:spdlog failed in remote:download-and-extract-tar during gtar --extract with exit status 2.

The suspicious part is that remote:curl for spdlog-extracted.tar.gz was marked up-to-date, but this log has no actual successful spdlog download step. So one plausible cause is a false-positive status check in remote:curl, which still uses diff <(...) <(...) with process substitution. If that incorrectly accepts a bad cached tarball, extraction would fail next.

We still don’t know the exact gtar error because stderr is suppressed by 2> /dev/null.

Feature

This PR improves the debuggability of failures in remote:curl by replacing the final checksum diff in the cmds path with explicit checks and clearer error reporting. remote:curl now:

• fails early if the output file does not exist
• reports when SHA256 computation fails
• reports when SHA256 output is unexpectedly empty
• prints both expected and actual SHA256 values on mismatch

This change does not alter the task’s success behavior. It only improves observability when checksum verification fails, making it easier to diagnose and reproduce the underlying issue, which will be addressed in a follow up bug fix PR.

Checklist

• The PR satisfies the contribution guidelines.
• This is a breaking change and that has been indicated in the PR title, OR this isn't a
  breaking change.
• Necessary docs have been updated, OR no docs need to be updated.

Validation performed

• No functionality changes. task tests:remote passes.

Summary by CodeRabbit

• Bug Fixes
  • Enhanced file validation with improved error handling and more detailed error messages for verification failures. File existence checks now occur before processing, and verification operations include explicit failure detection to prevent silent errors.

[coderabbitai]

Walkthrough

Replaced a diff-based SHA256 verification method in a remote file validation task with explicit validation steps. The new approach adds file existence checks, explicit error handling for SHA256 computation, empty output rejection, and detailed mismatch reporting instead of relying on implicit diff output behaviour.

Changes

Cohort / File(s)	Summary
SHA256 Verification Refactoring exports/taskfiles/utils/remote.yaml	Replaced diff-based hash comparison with explicit validation: added file existence check, SHA256 computation with error handling, empty hash rejection, and detailed expected vs. actual mismatch output.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main change: improving checksum comparison failure reporting in the remote:curl task through more explicit validation and clearer error messages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}