fix(quickget): add hash verification for Archcraft, KolibriOS, Mabox

[flexiondotorg]

Summary

Add checksum retrieval to quickget for distros that previously lacked hash verification. This ensures downloaded ISOs can be verified before use.

Changes

• quickget: add SHA256 retrieval for Archcraft (SourceForge .sha256sum)
• quickget: add SHA256 retrieval for KolibriOS (sha256sums.txt)
• quickget: add MD5 retrieval for Mabox Linux (repo.maboxlinux.org .md5)

Testing

• Run ./quickget --check <distro> <release> to validate URL and checksum parsing

Fixes #1545

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 3/5

• Checksum URL in quickget prepends v to ${RELEASE} while the download path uses ${RELEASE}; with latest this becomes vlatest, so checksum fetch likely fails and could break downloads.
• Given the medium severity and likely user-impacting failure in checksum retrieval, there is some merge risk to address before shipping.
• Pay close attention to quickget - align the checksum URL with the release path to avoid fetch failures.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="quickget">

<violation number="1" location="quickget:1608">
P2: The hash URL adds a `v` prefix (`v${RELEASE}`) that doesn't match the download path used above (`${RELEASE}`). With `releases_archcraft` returning `latest`, this becomes `vlatest`, so the checksum fetch will likely fail and HASH will be empty. Use the same release path as the download URL.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}