Tweak.

Projects/Src/Setup.InstFunc.pas

@@ -569,6 +569,7 @@ function GetSHA256OfFile(const F: TFile): TSHA256Digest;
 var
   Buf: array[0..65535] of Byte;
 begin
+  F.Seek(0);
   var Context: TSHA256Context;
   SHA256Init(Context);
   while True do begin

Projects/Src/Setup.Install.pas

@@ -280,7 +280,8 @@ end;
 procedure DoISSigVerify(const SourceF: TFile; const SourceFS: TFileStream;
   const SourceFilename: String; const ISSigAllowedKeys: AnsiString;
   out ExpectedFileHash: TSHA256Digest);
-{ Either SourceF or SourceFS must be set. Does not disable FS redirection. }
+{ Does not disable FS redirection. Either SourceF or SourceFS must be set, which
+  may be opened for writing instead of reading.  }
 begin
   if ((SourceF = nil) and (SourceFS = nil)) or ((SourceF <> nil) and (SourceFS <> nil)) then
     InternalError('DoISSigVerify: Invalid SourceF / SourceFS combination');
@@ -3706,7 +3707,6 @@ var
   LastError: DWORD;
   User, Pass, CleanUrl: String;
   HasCredentials : Boolean;
-  Base64: TBase64Encoding;
 begin
   if Url = '' then
     InternalError('DownloadTemporaryFile: Invalid Url value');
@@ -3755,7 +3755,6 @@ begin
   TempF := nil;
   TempFileLeftOver := False;
   HandleStream := nil;
-  Base64 := nil;
 
   try
     HasCredentials := GetCredentialsAndCleanUrl(URL, User, Pass, CleanUrl);
@@ -3786,8 +3785,12 @@ begin
     { Download to temporary file}
     HandleStream := THandleStream.Create(TempF.Handle);
     if HasCredentials then begin
-      Base64 := TBase64Encoding.Create(0);
-      HTTPClient.CustomHeaders['Authorization'] := 'Basic ' + Base64.Encode(User + ':' + Pass);
+      const Base64 = TBase64Encoding.Create(0);
+      try
+        HTTPClient.CustomHeaders['Authorization'] := 'Basic ' + Base64.Encode(User + ':' + Pass);
+      finally
+        Base64.Free;
+      end;
     end;
     HTTPResponse := HTTPClient.Get(CleanUrl, HandleStream);
     if HTTPDataReceiver.Aborted then
@@ -3795,7 +3798,7 @@ begin
     else if (HTTPResponse.StatusCode < 200) or (HTTPResponse.StatusCode > 299) then
       raise Exception.Create(FmtSetupMessage(msgErrorDownloadFailed, [IntToStr(HTTPResponse.StatusCode), HTTPResponse.StatusText]))
     else begin
-      { Download completed, get temporary file size and close it }
+      { Download completed, get size and close it }
       Result := HandleStream.Size;
       FreeAndNil(HandleStream);
 
@@ -3847,7 +3850,6 @@ begin
       TempFileLeftOver := False;
     end;
   finally
-    Base64.Free;
     HandleStream.Free;
     TempF.Free;
     HTTPClient.Free;