Patched code sample

"""
Module for secure package download verification.
"""
import os
import re
import hashlib
import tempfile
from typing import Dict, Optional, Set, Tuple
from urllib.parse import urlparse
import requests
from requests.adapters import HTTPAdapter
from requests.packages.urllib3.util.retry import Retry

class PackageError(Exception):
    pass

class Version:
    
    TRUSTED_SCHEMES = {'https'}
    TRUSTED_HOSTS = {'example.com'}
    MAX_SIZE = 100 * 1024 * 1024
    CHUNK_SIZE = 8192
    TIMEOUT = 30
    
    PACKAGE_PATTERN = r'^[a-zA-Z0-9][a-zA-Z0-9_.-]*$'
    
    def __init__(
        self,
        package_name: str,
        version: str,
        expected_hash: str,
        hash_type: str = 'sha256'
    ):
        
        try:

            if not re.match(self.PACKAGE_PATTERN, package_name):
                raise PackageError("Invalid package name")
                
            if not re.match(r'^[\w.-]+$', version):
                raise PackageError("Invalid version")
                
            if hash_type not in {'sha256', 'sha512'}:
                raise PackageError("Invalid hash type")
                
            hash_len = 64 if hash_type == 'sha256' else 128
            if not re.match(f'^[a-f0-9]{{{hash_len}}}$', expected_hash):
                raise PackageError("Invalid hash format")
                
            self.package_name = package_name
            self.version = version
            self.expected_hash = expected_hash
            self.hash_type = hash_type
            self.url = f"https://example.com/packages/{package_name}_{version}.deb"
            
            self.session = self._create_session()
            
        except Exception as e:
            raise PackageError(f"Initialization failed: {str(e)}")
            
    def _create_session(self) -> requests.Session:
        session = requests.Session()
        
        retry = Retry(
            total=3,
            backoff_factor=0.5,
            status_forcelist=[500, 502, 503, 504]
        )
        
        adapter = HTTPAdapter(
            max_retries=retry,
            pool_connections=10,
            pool_maxsize=10
        )
        
        session.mount('https://', adapter)
        
        return session
        
    def _validate_url(self) -> None:
        
        try:
            parsed = urlparse(self.url)
            
            if parsed.scheme not in self.TRUSTED_SCHEMES:
                raise PackageError("HTTPS required")
                
            if parsed.hostname not in self.TRUSTED_HOSTS:
                raise PackageError("Untrusted host")
                
        except Exception as e:
            if isinstance(e, PackageError):
                raise
            raise PackageError(f"URL validation failed: {str(e)}")
            
    def _verify_hash(self, file_path: str) -> None:
        
        try:
            hasher = hashlib.new(self.hash_type)
            
            with open(file_path, 'rb') as f:
                for chunk in iter(lambda: f.read(self.CHUNK_SIZE), b''):
                    hasher.update(chunk)
                    
            if hasher.hexdigest() != self.expected_hash:
                raise PackageError("Hash verification failed")
                
        except Exception as e:
            if isinstance(e, PackageError):
                raise
            raise PackageError(f"Hash verification failed: {str(e)}")
            
    def fetch_binary(self, output_dir: str) -> str:
        
        try:
            self._validate_url()
            
            with tempfile.NamedTemporaryFile(delete=False) as temp_file:
                try:
                    response = self.session.get(
                        self.url,
                        stream=True,
                        timeout=self.TIMEOUT
                    )
                    response.raise_for_status()
                    
                    content_length = response.headers.get('content-length')
                    if content_length and int(content_length) > self.MAX_SIZE:
                        raise PackageError("Package too large")
                        
                    size = 0
                    for chunk in response.iter_content(chunk_size=self.CHUNK_SIZE):
                        size += len(chunk)
                        if size > self.MAX_SIZE:
                            raise PackageError("Package too large")
                        temp_file.write(chunk)
                        
                    self._verify_hash(temp_file.name)
                    
                    output_path = os.path.join(
                        output_dir,
                        f"{self.package_name}_{self.version}.deb"
                    )
                    
                    os.replace(temp_file.name, output_path)
                    return output_path
                    
                except Exception:
                    try:
                        os.unlink(temp_file.name)
                    except OSError:
                        pass
                    raise
                    
        except requests.exceptions.RequestException as e:
            raise PackageError(f"Download failed: {str(e)}")
        except Exception as e:
            raise PackageError(f"Error fetching binary: {str(e)}")