fix(security): add SHA256 checksum verification to installer
The install script now verifies downloaded artifacts against checksums.txt from the GitHub release before extracting, protecting against corrupted or tampered downloads. - Downloads checksums.txt from the release - Supports both sha256sum (Linux) and shasum (macOS) - Fails safely with clear error messages on verification failure
- commit
- f154089fab7ab6c5b3f840366060b8b06b9fb7c4
- author
- brice · · 2026-01-17 07:55 UTC
- parent
- 79b3461
- signature
- GPG Verified
CD88F9E564E0102646FB6077A1A07C7C7C3E349D· arch-gpg Verified for the committer email
1 file · +39 -1
M install.sh +39 -1
| @@ -49,8 +49,46 @@ DOWNLOAD_URL="https://github.com/${REPO}/releases/latest/download/${TARBALL}" | |||
| 49 | 49 | TMP_DIR=$(mktemp -d) | |
| 50 | 50 | trap 'rm -rf "$TMP_DIR"' EXIT | |
| 51 | 51 | ||
| 52 | + | # Download checksums file | |
| 53 | + | CHECKSUMS_URL="https://github.com/${REPO}/releases/latest/download/checksums.txt" | |
| 54 | + | echo "Downloading checksums..." | |
| 55 | + | if ! curl -fsSL "$CHECKSUMS_URL" -o "$TMP_DIR/checksums.txt"; then | |
| 56 | + | echo "Error: Failed to download checksums file" | |
| 57 | + | exit 1 | |
| 58 | + | fi | |
| 59 | + | ||
| 52 | 60 | echo "Downloading ${TARBALL}..." | |
| 53 | - | curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$TARBALL" | |
| 61 | + | if ! curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$TARBALL"; then | |
| 62 | + | echo "Error: Failed to download ${TARBALL}" | |
| 63 | + | exit 1 | |
| 64 | + | fi | |
| 65 | + | ||
| 66 | + | # Verify checksum | |
| 67 | + | echo "Verifying checksum..." | |
| 68 | + | EXPECTED_CHECKSUM=$(grep "${TARBALL}" "$TMP_DIR/checksums.txt" | awk '{print $1}') | |
| 69 | + | if [ -z "$EXPECTED_CHECKSUM" ]; then | |
| 70 | + | echo "Error: Could not find checksum for ${TARBALL} in checksums.txt" | |
| 71 | + | exit 1 | |
| 72 | + | fi | |
| 73 | + | ||
| 74 | + | # Calculate actual checksum (works on both Linux and macOS) | |
| 75 | + | if command -v sha256sum >/dev/null 2>&1; then | |
| 76 | + | ACTUAL_CHECKSUM=$(sha256sum "$TMP_DIR/$TARBALL" | awk '{print $1}') | |
| 77 | + | elif command -v shasum >/dev/null 2>&1; then | |
| 78 | + | ACTUAL_CHECKSUM=$(shasum -a 256 "$TMP_DIR/$TARBALL" | awk '{print $1}') | |
| 79 | + | else | |
| 80 | + | echo "Error: Neither sha256sum nor shasum found. Cannot verify checksum." | |
| 81 | + | exit 1 | |
| 82 | + | fi | |
| 83 | + | ||
| 84 | + | if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then | |
| 85 | + | echo "Error: Checksum verification failed!" | |
| 86 | + | echo "Expected: $EXPECTED_CHECKSUM" | |
| 87 | + | echo "Actual: $ACTUAL_CHECKSUM" | |
| 88 | + | echo "The downloaded file may be corrupted or tampered with." | |
| 89 | + | exit 1 | |
| 90 | + | fi | |
| 91 | + | echo "Checksum verified successfully." | |
| 54 | 92 | ||
| 55 | 93 | echo "Extracting..." | |
| 56 | 94 | tar -xzf "$TMP_DIR/$TARBALL" -C "$TMP_DIR" | |
| @@ -49,8 +49,46 @@ DOWNLOAD_URL="https://github.com/${REPO}/releases/latest/download/${TARBALL}" | |||||
| 49 | TMP_DIR=$(mktemp -d) | 49 | TMP_DIR=$(mktemp -d) | ||
| 50 | trap 'rm -rf "$TMP_DIR"' EXIT | 50 | trap 'rm -rf "$TMP_DIR"' EXIT | ||
| 51 | 51 | ||||
| 52 | + | # Download checksums file | |||
| 53 | + | CHECKSUMS_URL="https://github.com/${REPO}/releases/latest/download/checksums.txt" | |||
| 54 | + | echo "Downloading checksums..." | |||
| 55 | + | if ! curl -fsSL "$CHECKSUMS_URL" -o "$TMP_DIR/checksums.txt"; then | |||
| 56 | + | echo "Error: Failed to download checksums file" | |||
| 57 | + | exit 1 | |||
| 58 | + | fi | |||
| 59 | + | ||||
| 52 | echo "Downloading ${TARBALL}..." | 60 | echo "Downloading ${TARBALL}..." | ||
| 53 | - | curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$TARBALL" | 61 | + | if ! curl -fsSL "$DOWNLOAD_URL" -o "$TMP_DIR/$TARBALL"; then |
| 62 | + | echo "Error: Failed to download ${TARBALL}" | |||
| 63 | + | exit 1 | |||
| 64 | + | fi | |||
| 65 | + | ||||
| 66 | + | # Verify checksum | |||
| 67 | + | echo "Verifying checksum..." | |||
| 68 | + | EXPECTED_CHECKSUM=$(grep "${TARBALL}" "$TMP_DIR/checksums.txt" | awk '{print $1}') | |||
| 69 | + | if [ -z "$EXPECTED_CHECKSUM" ]; then | |||
| 70 | + | echo "Error: Could not find checksum for ${TARBALL} in checksums.txt" | |||
| 71 | + | exit 1 | |||
| 72 | + | fi | |||
| 73 | + | ||||
| 74 | + | # Calculate actual checksum (works on both Linux and macOS) | |||
| 75 | + | if command -v sha256sum >/dev/null 2>&1; then | |||
| 76 | + | ACTUAL_CHECKSUM=$(sha256sum "$TMP_DIR/$TARBALL" | awk '{print $1}') | |||
| 77 | + | elif command -v shasum >/dev/null 2>&1; then | |||
| 78 | + | ACTUAL_CHECKSUM=$(shasum -a 256 "$TMP_DIR/$TARBALL" | awk '{print $1}') | |||
| 79 | + | else | |||
| 80 | + | echo "Error: Neither sha256sum nor shasum found. Cannot verify checksum." | |||
| 81 | + | exit 1 | |||
| 82 | + | fi | |||
| 83 | + | ||||
| 84 | + | if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then | |||
| 85 | + | echo "Error: Checksum verification failed!" | |||
| 86 | + | echo "Expected: $EXPECTED_CHECKSUM" | |||
| 87 | + | echo "Actual: $ACTUAL_CHECKSUM" | |||
| 88 | + | echo "The downloaded file may be corrupted or tampered with." | |||
| 89 | + | exit 1 | |||
| 90 | + | fi | |||
| 91 | + | echo "Checksum verified successfully." | |||
| 54 | 92 | ||||
| 55 | echo "Extracting..." | 93 | echo "Extracting..." | ||
| 56 | tar -xzf "$TMP_DIR/$TARBALL" -C "$TMP_DIR" | 94 | tar -xzf "$TMP_DIR/$TARBALL" -C "$TMP_DIR" | ||