feat(platform): add atomic HTTP download helper

internal/platform/download.go

@@ -0,0 +1,42 @@
+package platform
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+)
+
+// Download fetches url into destPath atomically (temp file + rename) with
+// the given file mode. Any non-2xx response returns an error and leaves
+// no file behind.
+func Download(ctx context.Context, url, destPath string, mode os.FileMode) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("download %s: http %d", url, resp.StatusCode)
+	}
+	tmp := destPath + ".tmp"
+	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, mode)
+	if err != nil {
+		return err
+	}
+	if _, err := io.Copy(f, resp.Body); err != nil {
+		f.Close()
+		os.Remove(tmp)
+		return err
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(tmp)
+		return err
+	}
+	return os.Rename(tmp, destPath)
+}

internal/platform/download_test.go

@@ -0,0 +1,45 @@
+package platform
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDownloadHappyPath(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("payload"))
+	}))
+	defer srv.Close()
+	dir := t.TempDir()
+	dest := filepath.Join(dir, "out.bin")
+	if err := Download(context.Background(), srv.URL, dest, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	got, _ := os.ReadFile(dest)
+	if string(got) != "payload" {
+		t.Fatalf("got %q want payload", got)
+	}
+	info, _ := os.Stat(dest)
+	if info.Mode().Perm() != 0o755 {
+		t.Fatalf("mode=%v want 0755", info.Mode().Perm())
+	}
+}
+
+func TestDownload404Errors(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "nope", http.StatusNotFound)
+	}))
+	defer srv.Close()
+	dir := t.TempDir()
+	dest := filepath.Join(dir, "out.bin")
+	if err := Download(context.Background(), srv.URL, dest, 0o644); err == nil {
+		t.Fatal("want error on 404")
+	}
+	if _, err := os.Stat(dest); !os.IsNotExist(err) {
+		t.Fatal("dest should not exist after failed download")
+	}
+}