[FEAT] Download signatures independently of modules

[0cwa]

I pulled the latest version. There is no custota.zip.sig, only custota-tool.zip.sig x64 Fedora

➜  .tmp git:(main) ✗ ls modules                     
alterinstaller.zip  custota.zip  oemunlockonboot.zip
bcr.zip             msd.zip
➜  .tmp git:(main) ✗ ls signatures
afsr.zip.sig            custota-tool.zip.sig
alterinstaller.zip.sig  msd.zip.sig
avbroot.zip.sig         oemunlockonboot.zip.sig
bcr.zip.sig

[*] Verifying SSH signature: .tmp/modules/custota.zip
Couldn't read signature file: No such file or directory
Could not verify signature.
Traceback (most recent call last):
  File "/home/user/PixeneOS/.tmp/tools/my-avbroot-setup/patch.py", line 1009, in <module>
    main()
  File "/home/user/PixeneOS/.tmp/tools/my-avbroot-setup/patch.py", line 1000, in main
    run(args, Path(temp_dir))
  File "/home/user/PixeneOS/.tmp/tools/my-avbroot-setup/patch.py", line 919, in run
    inject_custota(
  File "/home/user/PixeneOS/.tmp/tools/my-avbroot-setup/patch.py", line 420, in inject_custota
    verify_ssh_sig(module_zip, module_sig, SSH_PUBLIC_KEY_CHENXIAOLONG)
  File "/home/user/PixeneOS/.tmp/tools/my-avbroot-setup/patch.py", line 402, in verify_ssh_sig
    subprocess.check_call([
  File "/usr/lib64/python3.12/subprocess.py", line 413, in check_call
    raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '['ssh-keygen', '-Y', 'verify', '-f', '/tmp/tmpl6g6fou_', '-I', 'trusted', '-n', 'file', '-s', PosixPath('.tmp/signatures/custota.zip.sig')]' returned non-zero exit status 255.
Cleanup is disabled. Exiting...

[pixincreate]

I just tested this. It is indeed getting downloaded.

[0cwa]

Ok, I retested and it's there, it must've 404'd when it tried to download and then didn't download again because I had custota.zip already downloaded?

[pixincreate]

You should be having the logs of it downloading, right? Can you please confirm with that once?

If it exist already, even that should printed stating 'custota.zip' file already exists in '.tmp/modules'.

[0cwa]

I deleted the .tmp, retried and it works. I'm not at my workstation, but I'm guessing this is probably just a minor bug where if the module custota.zip is already downloaded, it doesn't download the signature for it, even if the signature is missing.

[pixincreate]

Yes, this was an intentional decision from my end as it unnecessarily increases complexity in the fetcher file.

I'll have a look at this again today once patcher is completed.

[pixincreate]

I did some refactoring around retries to address #9.

Now that, during download, we verify the files. If any file goes missing and you've ADDITIONALS[RETRY] flag set to true it will try to download again (max 3 retries, fails afterward).