download method
Downloads template's manifest from <baseUrl>/cubes/<file> and
verifies its sha256 — a mismatch refuses the bytes.
Implementation
Future<String> download(CubeRegistryTemplate template) async {
final url = '$baseUrl/cubes/${template.file}';
final body = await _get(url);
final actual = sha256.convert(utf8.encode(body)).toString();
if (actual != template.sha256) {
throw ConfigException(
'cube registry: sha256 mismatch for ${template.id} ($url): '
'expected ${template.sha256}, got $actual — refusing the manifest',
);
}
return body;
}