transfer: compare download roots as hashes, not as text (#195)

validateDownloadFile compared the caller's root string against Hash.Hex's canonical
rendering. Every other step normalises it through common.HexToHash - downloadAndValidate
does exactly that for the file query and the existence check - but this one compared raw
text, and HexToHash accepts forms Hex never emits: uppercase digits, a missing 0x
prefix, fewer than 64 digits.

So download --root 0xABC... transferred the whole file, validated its merkle root
correctly, then failed with "Merkle root mismatch" over the spelling of the argument.
The message printed only the downloaded root, so the two values looked identical apart
from case and gave no hint the comparison was textual.

Compare hashes, and name both roots in the error so a genuine mismatch is legible.

Also changed checkFileExistence from comparing Hex renderings to comparing hashes. That
one was already correct, since both sides were canonical, but comparing hashes is
clearer and removes the pattern from the file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 0g-peterzhb

transfer/downloader.go

@@ -288,7 +288,7 @@ func checkFileExistence(filename string, hash common.Hash) error {
 		return errors.WithMessage(err, "Failed to create file merkle tree")
 	}
 
-	if tree.Root().Hex() == hash.Hex() {
+	if tree.Root() == hash {
 		return ErrFileAlreadyExists
 	}
 
@@ -338,8 +338,13 @@ func (downloader *Downloader) validateDownloadFile(root, filename string, fileSi
 		return errors.WithMessage(err, "Failed to create merkle tree")
 	}
 
-	if rootHex := tree.Root().Hex(); rootHex != root {
-		return errors.Errorf("Merkle root mismatch, downloaded = %v", rootHex)
+	// Compare hashes, not strings. The caller's root is whatever text they passed in, and
+	// common.HexToHash accepts forms that Hash.Hex never produces - uppercase digits, a
+	// missing 0x prefix, fewer than 64 digits - so every other step here normalised it
+	// while this one rejected it. The download would complete and then be discarded for
+	// its spelling.
+	if expected := common.HexToHash(root); tree.Root() != expected {
+		return errors.Errorf("Merkle root mismatch, expected = %v, downloaded = %v", expected.Hex(), tree.Root().Hex())
 	}
 
 	downloader.logger.Info("Succeeded to validate the downloaded file")

transfer/downloader_validate_test.go

@@ -0,0 +1,69 @@
+package transfer
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/0gfoundation/0g-storage-client/core"
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Every step of the download normalises the caller's root through common.HexToHash,
+// except the final validation, which compared it as text against Hash.Hex's canonical
+// form. So a root spelled in any other accepted way - uppercase digits, no 0x prefix,
+// fewer than 64 digits - completed its download and was then rejected for its spelling.
+func TestValidateDownloadFile_AcceptsEquivalentRootForms(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "data.dat")
+	content := []byte("some downloaded content")
+	require.NoError(t, os.WriteFile(path, content, 0644))
+
+	root, err := core.MerkleRoot(path)
+	require.NoError(t, err)
+	canonical := root.Hex()
+
+	downloader := &Downloader{logger: logrus.New()}
+
+	for _, form := range []struct {
+		name string
+		root string
+	}{
+		{"canonical", canonical},
+		{"uppercase digits", "0x" + strings.ToUpper(strings.TrimPrefix(canonical, "0x"))},
+		{"no 0x prefix", strings.TrimPrefix(canonical, "0x")},
+	} {
+		t.Run(form.name, func(t *testing.T) {
+			assert.NoError(t, downloader.validateDownloadFile(form.root, path, int64(len(content))),
+				"%q denotes the same hash as %q", form.root, canonical)
+		})
+	}
+}
+
+// A genuinely different root must still be rejected, and the message should name both.
+func TestValidateDownloadFile_RejectsDifferentRoot(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "data.dat")
+	content := []byte("some downloaded content")
+	require.NoError(t, os.WriteFile(path, content, 0644))
+
+	downloader := &Downloader{logger: logrus.New()}
+	err := downloader.validateDownloadFile(
+		"0xbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbadbad0", path, int64(len(content)))
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "Merkle root mismatch")
+	assert.Contains(t, err.Error(), "expected", "the message should name the root that was asked for")
+}
+
+func TestValidateDownloadFile_RejectsSizeMismatch(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "data.dat")
+	require.NoError(t, os.WriteFile(path, []byte("short"), 0644))
+
+	root, err := core.MerkleRoot(path)
+	require.NoError(t, err)
+
+	downloader := &Downloader{logger: logrus.New()}
+	assert.ErrorContains(t, downloader.validateDownloadFile(root.Hex(), path, 9999), "File size mismatch")
+}