Use standard base fetch and checksum tools

README.md

@@ -14,6 +14,10 @@ The adversarial and demonstration recipes used by the base-system acceptance
 suite are deliberately not part of this collection. They live in
 `mouse-src/tests/fixtures/ports`.
 
+The shared framework uses the base system's ChimeraUtils `fetch` and `sha256`
+commands. TLS trust comes from MOUSE's pinned CA bundle; the ports tree does
+not carry private download or cryptographic implementations.
+
 Run the collection checks with:
 
 ```sh

ports/Mk/Scripts/checksum.sh

@@ -25,7 +25,7 @@ for distfile in "$@"; do
 	case "$expected" in
 		*[!0-9a-f]*) printf '%s\n' "invalid checksum for $distfile" >&2; exit 1 ;;
 	esac
-	actual=$("$sha256_command" "$distdir/$distfile")
+	actual=$("$sha256_command" -q "$distdir/$distfile")
 	[ "$actual" = "$expected" ] || {
 		printf '%s\n' \
 		    "$distfile checksum mismatch: expected $expected, got $actual" >&2

ports/Mk/Scripts/fetch.sh

@@ -18,7 +18,13 @@ for distfile in "$@"; do
 		""|*/*) printf '%s\n' "unsafe distfile name: $distfile" >&2; exit 1 ;;
 	esac
 	if [ ! -f "$distdir/$distfile" ]; then
-		"$fetch_command" "$master_sites$distfile" \
+		temporary="$distdir/$distfile.part"
-		    "$distdir/$distfile"
+		rm -f "$temporary"
+		if "$fetch_command" -o "$temporary" "$master_sites$distfile"; then
+			mv "$temporary" "$distdir/$distfile"
+		else
+			rm -f "$temporary"
+			exit 1
+		fi
 	fi
 done

ports/Mk/mouse.port.mk

@@ -38,8 +38,8 @@ NO_EXTRACT?=	no
 EXTRACT_CMD?=	/usr/bin/tar
 
 MOUSE_PACKAGE?=	/usr/libexec/mouse-package
-MOUSE_FETCH?=	/usr/libexec/mouse-fetch
+MOUSE_FETCH?=	/usr/bin/fetch
-MOUSE_SHA256?=	/usr/bin/mouse-sha256
+MOUSE_SHA256?=	/usr/bin/sha256
 MOUSE_SH?=	/bin/sh
 
 FETCH_SCRIPT=	${PORTSDIR}/Mk/Scripts/fetch.sh