Require checksums for prebuilt installers

2026-07-12 22:00:01 -04:00
parent efddd1544e
commit 5a85e6508d
3 changed files with 22 additions and 4 deletions
@@ -185,8 +185,7 @@ function Verify-ArchiveChecksum($Url, $Archive) {
        Invoke-WebRequest -UseBasicParsing -Uri "$Url.sha256" -OutFile $checksumPath
    }
    catch {
-        Write-Warning "prebuilt checksum unavailable; continuing without sidecar verification"
-        return
+        throw "prebuilt checksum unavailable; refusing unverified binary for $Url"
    }
    $expected = ((Get-Content $checksumPath -Raw).Trim() -split "\s+")[0].ToLowerInvariant()
    $actual = (Get-FileHash -Algorithm SHA256 $Archive).Hash.ToLowerInvariant()