# `Safe.Binary`
[🔗](https://github.com/erlang-solutions/safe-mix-plugin/blob/main/lib/mix/tasks/safe/binary.ex#L1)

Manages downloading, verifying, and caching the SAFE binary.

The binary is stored at `<project_root>/_build/safe/safe`. A SHA-256
checksum is verified against the manifest before the tarball is extracted.

# `binary_path`

Returns the expected path of the SAFE binary for the given project.

# `compute_checksum`

Computes a lowercase hex SHA-256 digest of `binary_data`.

# `detect_arch`

Detects the CPU architecture and normalises it to the string used in SAFE
release filenames. Returns `{:ok, "x86_64"}` on all supported architectures
(Intel, AMD, ARM64/Apple Silicon), or `{:error, :unsupported_arch}`.

SAFE ships a universal macOS binary and an x86_64 Linux binary, so all
common architectures map to "x86_64".

# `detect_os`

Detects the current OS. Returns `{:ok, "linux"}`, `{:ok, "macos"}`, or
`{:error, :unsupported_platform}`.

# `ensure_binary_available`

Ensures the SAFE binary is present at `_build/safe/safe`.

If the binary already exists, returns `:ok` immediately.
Otherwise resolves the version (from `safe.lock` or the S3 manifest),
downloads the tarball, verifies its checksum, extracts it, and writes
`safe.lock`.

# `normalize_arch`

Normalises an architecture string to the value used in SAFE release filenames.

# `verify_checksum`

Returns true when `actual` and `expected` represent the same checksum.
Comparison is case-insensitive and trims surrounding whitespace.

---

*Consult [api-reference.md](api-reference.md) for complete listing*