Merge pull request #24 from bnema/fix/installer-checksum-verification

fix(security): add SHA256 checksum verification to installer

commit: abf83576c635a6883afcfa28cc6b3fd64b0770da
author: bnema · 9mo ago · 2026-01-17 07:58 UTC
committer: GitHub · 9mo ago · 2026-01-17 07:58 UTC
merge of: 090e7ba + d6ffbc4 · diff against the first parent
signature: unsigned

1 file · +45 -1

M install.sh +45 -1


@@ -49,8 +49,52 @@ DOWNLOAD_URL="https://github.com/${REPO}/releases/latest/download/${TARBALL}"
49	49		TMP_DIR=$(mktemp -d)
50	50		trap 'rm -rf "$TMP_DIR"' EXIT
51	51
	52	+	# Download checksums file
	53	+	CHECKSUMS_URL="https://github.com/${REPO}/releases/latest/download/checksums.txt"
	54	+	echo "Downloading checksums..."
	55	+	if ! curl -fsSL "$CHECKSUMS_URL" -o "$TMP_DIR/checksums.txt"; then
	56	+	echo "Error: Failed to download checksums file"
	57	+	exit 1
	58	+	fi
	59	+
52	60		echo "Downloading ${TARBALL}..."
53		-	curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$TARBALL"
	61	+	if ! curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$TARBALL"; then
	62	+	echo "Error: Failed to download ${TARBALL}"
	63	+	exit 1
	64	+	fi
	65	+
	66	+	# Verify checksum
	67	+	echo "Verifying checksum..."
	68	+	EXPECTED_CHECKSUM=$(grep -E "[[:space:]]${TARBALL}\$" "$TMP_DIR/checksums.txt" \| awk '{print $1}')
	69	+	if [ -z "$EXPECTED_CHECKSUM" ]; then
	70	+	echo "Error: Could not find checksum for ${TARBALL} in checksums.txt"
	71	+	exit 1
	72	+	fi
	73	+
	74	+	# Calculate actual checksum (works on both Linux and macOS)
	75	+	if command -v sha256sum >/dev/null 2>&1; then
	76	+	ACTUAL_CHECKSUM=$(sha256sum "$TMP_DIR/$TARBALL" \| awk '{print $1}')
	77	+	elif command -v shasum >/dev/null 2>&1; then
	78	+	ACTUAL_CHECKSUM=$(shasum -a 256 "$TMP_DIR/$TARBALL" \| awk '{print $1}')
	79	+	else
	80	+	echo "Error: Neither 'sha256sum' nor 'shasum' was found. Cannot verify checksum."
	81	+	echo ""
	82	+	echo "Please install one of these tools:"
	83	+	echo " Debian/Ubuntu: sudo apt-get install coreutils"
	84	+	echo " Fedora/RHEL: sudo dnf install coreutils"
	85	+	echo " Alpine: apk add coreutils"
	86	+	echo " macOS: shasum should be pre-installed"
	87	+	exit 1
	88	+	fi
	89	+
	90	+	if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
	91	+	echo "Error: Checksum verification failed!"
	92	+	echo "Expected: $EXPECTED_CHECKSUM"
	93	+	echo "Actual: $ACTUAL_CHECKSUM"
	94	+	echo "The downloaded file may be corrupted or tampered with."
	95	+	exit 1
	96	+	fi
	97	+	echo "Checksum verified successfully."
54	98
55	99		echo "Extracting..."
56	100		tar -xzf "$TMP_DIR/$TARBALL" -C "$TMP_DIR"


@@ -49,8 +49,52 @@ DOWNLOAD_URL="https://github.com/${REPO}/releases/latest/download/${TARBALL}"
49		TMP_DIR=$(mktemp -d)	49		TMP_DIR=$(mktemp -d)
50		trap 'rm -rf "$TMP_DIR"' EXIT	50		trap 'rm -rf "$TMP_DIR"' EXIT
51			51
			52	+	# Download checksums file
			53	+	CHECKSUMS_URL="https://github.com/${REPO}/releases/latest/download/checksums.txt"
			54	+	echo "Downloading checksums..."
			55	+	if ! curl -fsSL "$CHECKSUMS_URL" -o "$TMP_DIR/checksums.txt"; then
			56	+	echo "Error: Failed to download checksums file"
			57	+	exit 1
			58	+	fi
			59	+
52		echo "Downloading ${TARBALL}..."	60		echo "Downloading ${TARBALL}..."
53	-	curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$TARBALL"	61	+	if ! curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$TARBALL"; then
			62	+	echo "Error: Failed to download ${TARBALL}"
			63	+	exit 1
			64	+	fi
			65	+
			66	+	# Verify checksum
			67	+	echo "Verifying checksum..."
			68	+	EXPECTED_CHECKSUM=$(grep -E "[[:space:]]${TARBALL}\$" "$TMP_DIR/checksums.txt" \| awk '{print $1}')
			69	+	if [ -z "$EXPECTED_CHECKSUM" ]; then
			70	+	echo "Error: Could not find checksum for ${TARBALL} in checksums.txt"
			71	+	exit 1
			72	+	fi
			73	+
			74	+	# Calculate actual checksum (works on both Linux and macOS)
			75	+	if command -v sha256sum >/dev/null 2>&1; then
			76	+	ACTUAL_CHECKSUM=$(sha256sum "$TMP_DIR/$TARBALL" \| awk '{print $1}')
			77	+	elif command -v shasum >/dev/null 2>&1; then
			78	+	ACTUAL_CHECKSUM=$(shasum -a 256 "$TMP_DIR/$TARBALL" \| awk '{print $1}')
			79	+	else
			80	+	echo "Error: Neither 'sha256sum' nor 'shasum' was found. Cannot verify checksum."
			81	+	echo ""
			82	+	echo "Please install one of these tools:"
			83	+	echo " Debian/Ubuntu: sudo apt-get install coreutils"
			84	+	echo " Fedora/RHEL: sudo dnf install coreutils"
			85	+	echo " Alpine: apk add coreutils"
			86	+	echo " macOS: shasum should be pre-installed"
			87	+	exit 1
			88	+	fi
			89	+
			90	+	if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
			91	+	echo "Error: Checksum verification failed!"
			92	+	echo "Expected: $EXPECTED_CHECKSUM"
			93	+	echo "Actual: $ACTUAL_CHECKSUM"
			94	+	echo "The downloaded file may be corrupted or tampered with."
			95	+	exit 1
			96	+	fi
			97	+	echo "Checksum verified successfully."
54			98
55		echo "Extracting..."	99		echo "Extracting..."
56		tar -xzf "$TMP_DIR/$TARBALL" -C "$TMP_DIR"	100		tar -xzf "$TMP_DIR/$TARBALL" -C "$TMP_DIR"