fix: harden desktop release OSS uploads

server/internal/ops/app/desktop_client_release.go

@@ -602,8 +602,7 @@ func (s *DesktopClientReleaseService) InitiateDirectUpload(
 			return nil, err
 		}
 	}
-	contentMD5, err := normalizeDesktopReleaseContentMD5(in.ContentMD5)
-	if err != nil {
+	if _, err := normalizeDesktopReleaseContentMD5(in.ContentMD5); err != nil {
 		return nil, err
 	}
 
@@ -635,7 +634,7 @@ func (s *DesktopClientReleaseService) InitiateDirectUpload(
 		ctx,
 		objectKey,
 		detectDesktopReleaseContentType(fileName, nil),
-		contentMD5,
+		"",
 		desktopClientReleaseDirectUploadTTL,
 	)
 	if err != nil {
@@ -724,6 +723,21 @@ func (s *DesktopClientReleaseService) CompleteDirectUpload(
 			return nil, response.ErrBadRequest(40078, "direct_upload_not_found", "OSS 直传文件尚未完成")
 		}
 	}
+	actualSHA, actualSize, err := hashDesktopClientReleaseStorageObject(ctx, s.storage, objectKey)
+	if err != nil {
+		if errors.Is(err, objectstorage.ErrObjectNotFound) {
+			return nil, response.ErrBadRequest(40078, "direct_upload_not_found", "OSS 直传文件尚未完成")
+		}
+		appErr := response.ErrInternal(50092, "desktop_client_release_upload_failed", err.Error())
+		appErr.Cause = err
+		return nil, appErr
+	}
+	if actualSize != in.FileSizeBytes {
+		return nil, response.ErrBadRequest(40079, "direct_upload_size_mismatch", "OSS 直传文件大小不匹配，请重新上传")
+	}
+	if actualSHA != sha256Hex {
+		return nil, response.ErrBadRequest(40070, "invalid_sha256", "OSS 直传文件 SHA256 不匹配，请重新上传")
+	}
 
 	return &DesktopClientReleaseUploadResult{
 		OSSObjectKey:  objectKey,
@@ -733,6 +747,34 @@ func (s *DesktopClientReleaseService) CompleteDirectUpload(
 	}, nil
 }
 
+func hashDesktopClientReleaseStorageObject(
+	ctx context.Context,
+	storage objectstorage.Client,
+	objectKey string,
+) (string, int64, error) {
+	if readerClient, ok := storage.(objectstorage.ObjectReaderClient); ok {
+		reader, err := readerClient.GetReader(ctx, objectKey)
+		if err != nil {
+			return "", 0, err
+		}
+		defer reader.Close()
+
+		hasher := sha256.New()
+		size, err := io.Copy(hasher, reader)
+		if err != nil {
+			return "", 0, err
+		}
+		return hex.EncodeToString(hasher.Sum(nil)), size, nil
+	}
+
+	content, err := storage.GetBytes(ctx, objectKey)
+	if err != nil {
+		return "", 0, err
+	}
+	actualSHA := sha256.Sum256(content)
+	return hex.EncodeToString(actualSHA[:]), int64(len(content)), nil
+}
+
 func MaxDesktopClientReleaseMultipartBytes() int64 {
 	return MaxDesktopClientReleaseUploadBytes + desktopClientReleaseMultipartOverheadBytes
 }