制品下载完整性与重试退避治理（checksum-retry-backoff）最佳实践

实现示例type Artifact = { url: string; sha256: string } function hex64(h: string): boolean { return /^[A-Fa-f0-9]{64}$/.test(h) } function validUrl(u: string): boolean { try { const x = new URL(u); return x.protocol === 'https:' } catch { return false } } function backoff(attempt: number, baseMs: number): number { return Math.min(baseMs * 2 ** attempt, 30000) } function evaluate(a: Artifact): { ok: boolean; errors: string[] } { const errors: string[] = []; if (!validUrl(a.url)) errors.push('url'); if (!hex64(a.sha256)) errors.push('sha256'); return { ok: errors.length === 0, errors } } 审计与运行治理审计下载摘要与重试策略；异常阻断并输出修复建议。来源域与回退镜像需在白名单内。