Repository: duckdb/duckdb
File: src/main/extension/extension_install.cpp (C++)

Code before:

static void WriteExtensionFileToDisk(QueryContext &query_context, FileSystem &fs, const string &path, void *data,
                                     idx_t data_size, DBConfig &config) {
	// Open target_file, at this points ending with '?duckdb_extension' (but not '.')
	auto target_file =
	    fs.OpenFile(path, FileFlags::FILE_FLAGS_WRITE | FileFlags::FILE_FLAGS_APPEND |
	                          FileFlags::FILE_FLAGS_FILE_CREATE_NEW | FileFlags::FILE_FLAGS_ENABLE_DUCKDB_EXTENSION);
	// Write content to the file
	target_file->Write(query_context, data, data_size);

	auto parsed_metadata = ExtensionHelper::ParseExtensionMetaData(*target_file);

	if (!config.options.allow_unsigned_extensions) {
		bool signature_valid;
		if (parsed_metadata.AppearsValid()) {
			signature_valid = ExtensionHelper::CheckExtensionSignature(*target_file, parsed_metadata,
			                                                           config.options.allow_community_extensions);
		} else {
			signature_valid = false;
		}

		if (!signature_valid) {
			target_file->Close();
			target_file.reset();
			fs.TryRemoveFile(path);
			throw IOException("Attempting to install an extension file that hasn't a valid signature, see "
			                  "https://duckdb.org/docs/stable/operations_manual/securing_duckdb/securing_extensions");
		}
	}

	// Now signature has been checked

	target_file->Close();
	target_file.reset();
}

static void WriteExtensionMetadataFileToDisk(FileSystem &fs, const string &path, ExtensionInstallInfo &metadata) {
	auto file_writer = BufferedFileWriter(fs, path);
	BinarySerializer::Serialize(metadata, file_writer);
	file_writer.Sync();
}

string ExtensionHelper::ExtensionUrlTemplate(optional_ptr<const DatabaseInstance> db,
                                             const ExtensionRepository &repository, const string &version) {
	string versioned_path;
	if (!version.empty()) {
		versioned_path = "/${NAME}/" + version + "/${REVISION}/${PLATFORM}/${NAME}.duckdb_extension";
	} else {
		versioned_path = "/${REVISION}/${PLATFORM}/${NAME}.duckdb_extension";
	}
	string default_endpoint = ExtensionRepository::DEFAULT_REPOSITORY_URL;

Review comment (suggestion):
Maybe use the error manager here similar to what we do for `ErrorType::UNSIGNED_EXTENSION` so we can override suggestions for it

Code after:

static void WriteExtensionFileToDisk(QueryContext &query_context, FileSystem &fs, const string &path, void *data,
                                     idx_t data_size, DBConfig &config) {
	if (!config.options.allow_unsigned_extensions) {
		const bool signature_valid = ExtensionHelper::CheckExtensionBufferSignature(
		    static_cast<char *>(data), data_size, config.options.allow_community_extensions);
		if (!signature_valid) {
			throw IOException("Attempting to install an extension file that doesn't have a valid signature, see "
			                  "https://duckdb.org/docs/stable/operations_manual/securing_duckdb/securing_extensions");
		}
	}

	// Now signature has been checked (if signature checking is enabled)

	// Open target_file, at this points ending with '.duckdb_extension'
	auto target_file =
	    fs.OpenFile(path, FileFlags::FILE_FLAGS_WRITE | FileFlags::FILE_FLAGS_READ | FileFlags::FILE_FLAGS_APPEND |
	                          FileFlags::FILE_FLAGS_FILE_CREATE_NEW | FileFlags::FILE_FLAGS_ENABLE_EXTENSION_INSTALL);
	// Write content to the file
	target_file->Write(query_context, data, data_size);

	target_file->Close();
	target_file.reset();
}

static void WriteExtensionMetadataFileToDisk(FileSystem &fs, const string &path, ExtensionInstallInfo &metadata) {
	auto file_writer = BufferedFileWriter(fs, path);
	BinarySerializer::Serialize(metadata, file_writer);
	file_writer.Sync();
}

string ExtensionHelper::ExtensionUrlTemplate(optional_ptr<const DatabaseInstance> db,
                                             const ExtensionRepository &repository, const string &version) {
	string versioned_path;
	if (!version.empty()) {
		versioned_path = "/${NAME}/" + version + "/${REVISION}/${PLATFORM}/${NAME}.duckdb_extension";
	} else {
		versioned_path = "/${REVISION}/${PLATFORM}/${NAME}.duckdb_extension";
	}
	string default_endpoint = ExtensionRepository::DEFAULT_REPOSITORY_URL;
#ifdef WASM_LOADABLE_EXTENSIONS
	versioned_path = versioned_path + ".wasm";
#else
	versioned_path = versioned_path + CompressionExtensionFromType(FileCompressionType::GZIP);
#endif
	string url_template = repository.path + versioned_path;
	return url_template;
}

string ExtensionHelper::ExtensionFinalizeUrlTemplate(const string &url_template, const string &extension_name) {
	auto url = StringUtil::Replace(url_template, "${REVISION}", GetVersionDirectoryName());