feat: extend certificate pinning to all TLS protocols and add SSH

host-key pinning

cmd/goget/app.go

@@ -606,6 +606,8 @@ func (a *app) execute() int {
 		Ctx:               ctx,
 		SSHKnownHosts:     *f.KnownHosts,
 		SSHInsecure:       *f.SSHInsecure,
+		PinnedCertHash:    *f.PinnedCert,
+		PinnedHostKey:     *f.PinnedHostKey,
 	}
 
 	// Configure TLS for WebDAV if supported.

cmd/goget/flags.go

@@ -150,6 +150,7 @@ type Flags struct {
 	Referer         *string
 	RetryDelay      *time.Duration
 	PinnedCert      *string
+	PinnedHostKey   *string
 	AllowPrivate    *bool
 	Range           *string
 	ConnectTimeout  *time.Duration
@@ -289,7 +290,8 @@ func defineFlags(fs *flag.FlagSet, cfg *config.Config) *Flags {
 		Compressed:      fs.Bool("compressed", false, "Send Accept-Encoding header for auto-decompression"),
 		Referer:         fs.String("referer", "", "Send Referer header"),
 		RetryDelay:      fs.Duration("retry-delay", 0, "Delay between retry attempts"),
-		PinnedCert:      fs.String("pinned-cert", "", "SHA-256 hash of server certificate for pinning"),
+		PinnedCert:      fs.String("pinned-cert", "", "SHA-256 hash of server certificate for pinning (TLS protocols: HTTPS, FTPS, Gemini, WebDAVS)"),
+		PinnedHostKey:   fs.String("pinned-host-key", "", "SSH host key fingerprint for pinning (SFTP). Accepts 'SHA256:<base64>' (ssh-keygen -lf) or raw hex SHA-256."),
 		AllowPrivate:    fs.Bool("allow-private", false, "Allow connections to private/internal IPs (disables SSRF protection)"),
 		Range:           fs.String("range", "", "Download only a range of bytes (e.g., 0-1000)"),
 		ConnectTimeout:  fs.Duration("connect-timeout", 0, "Timeout for connection establishment"),