From 720d5605ae5683f8eafed09d572cb06e73a77b12 Mon Sep 17 00:00:00 2001
From: Hukla <129692708+huklaa@users.noreply.github.com>
Date: Wed, 2 Sep 2026 19:40:03 +0300
Subject: [PATCH 1/4] fix(arcup): reject empty bootstrap downloads

---
 arcup/install | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arcup/install b/arcup/install
index b9a8d2bf..6a98ecb5 100755
--- a/arcup/install
+++ b/arcup/install
@@ -72,7 +72,7 @@ main() {
         error "curl not found. Please install curl."
     fi
 
-    if ! curl_with_headers -#fL --max-time 300 -o "$_INSTALL_TMP_FILE" "$ARCUP_URL" ; then
+    if ! curl_with_headers -#fL --max-time 300 -o "$_INSTALL_TMP_FILE" "$ARCUP_URL" || [[ ! -s "$_INSTALL_TMP_FILE" ]]; then
         error "failed to download arcup from '$ARCUP_URL'"
     fi
 

From 980f688672de97ecbae09af3fb7e94ab86277625 Mon Sep 17 00:00:00 2001
From: Hukla <129692708+huklaa@users.noreply.github.com>
Date: Wed, 2 Sep 2026 19:40:32 +0300
Subject: [PATCH 2/4] test(arcup): cover false-success empty download

---
 arcup/test_install.sh | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 arcup/test_install.sh

diff --git a/arcup/test_install.sh b/arcup/test_install.sh
new file mode 100644
index 00000000..ae8e266c
--- /dev/null
+++ b/arcup/test_install.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEST_TMP="$(mktemp -d)"
+export ARCUP_INSTALL_SKIP_MAIN=1
+export ARC_DIR="$TEST_TMP/arc"
+export ARC_BIN_DIR="$ARC_DIR/bin"
+
+# shellcheck source=install
+source "$SCRIPT_DIR/install"
+trap 'rm -rf "$TEST_TMP"' EXIT
+
+# curl 8.14.0/8.14.1 can print an HTTP error but return success when
+# --retry and --fail are combined. Reproduce that contract violation by
+# returning 0 without writing the requested output file.
+curl_with_headers() {
+    return 0
+}
+
+out="$TEST_TMP/install.out"
+if (main) >"$out" 2>&1; then
+    echo "FAIL: empty bootstrap download was accepted" >&2
+    cat "$out" >&2
+    exit 1
+fi
+
+if ! grep -q "failed to download arcup" "$out"; then
+    echo "FAIL: expected bootstrap download error was not reported" >&2
+    cat "$out" >&2
+    exit 1
+fi
+
+if [[ -e "$ARC_BIN_DIR/arcup" ]]; then
+    echo "FAIL: empty arcup executable was installed" >&2
+    exit 1
+fi
+
+echo "PASS: empty bootstrap download is rejected"

From 65a8e9b97b4541081332aab1370380fc82ddecd1 Mon Sep 17 00:00:00 2001
From: Hukla <129692708+huklaa@users.noreply.github.com>
Date: Wed, 2 Sep 2026 20:33:17 +0300
Subject: [PATCH 3/4] test(arcup): make install regression executable

---
 arcup/test_install.sh | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 arcup/test_install.sh

diff --git a/arcup/test_install.sh b/arcup/test_install.sh
old mode 100644
new mode 100755

From 080e19feed01f6bef0bce2042d18a08d7412a1bc Mon Sep 17 00:00:00 2001
From: Hukla <129692708+huklaa@users.noreply.github.com>
Date: Thu, 3 Sep 2026 00:07:21 +0300
Subject: [PATCH 4/4] fix(arcup): reject empty API downloads

---
 arcup/arcup | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arcup/arcup b/arcup/arcup
index 3590cd36..4141ee0e 100755
--- a/arcup/arcup
+++ b/arcup/arcup
@@ -6,7 +6,7 @@ set -euo pipefail
 
 # NOTE: if you make modifications to this script, please increment the version number.
 # WARNING: the SemVer pattern: major.minor.patch must be followed as we use it to determine if the script is up to date.
-ARCUP_INSTALLER_VERSION="0.2.0"
+ARCUP_INSTALLER_VERSION="0.2.1"
 
 REPO="${ARC_REPO:-circlefin/arc-node}"
 if [[ -n "${ARC_REPO:-}" ]] && [[ ! "$ARC_REPO" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
@@ -350,7 +350,7 @@ download_file_with_github_api() {
     download_url=$(resolve_github_asset_download_url "$asset_api_url") || return 1
 
     if curl "${CURL_RETRY_ARGS[@]}" -fL --max-time 900 -o "$output_path" "$download_url" >/dev/null 2>&1; then
-        [[ -f "$output_path" ]] && return 0
+        [[ -s "$output_path" ]] && return 0
     fi
 
     rm -f "$output_path"
@@ -838,4 +838,4 @@ main() {
 
 if [[ "${ARCUP_SKIP_MAIN:-}" != "1" ]]; then
     main
-fi
+fi
\ No newline at end of file