Require checksums for prebuilt installers

2026-07-12 22:00:01 -04:00
parent efddd1544e
commit 5a85e6508d
3 changed files with 22 additions and 4 deletions
@@ -330,8 +330,8 @@ verify_archive_checksum() {
  archive="$2"
  checksum_file="$3"
  if ! curl -fsL "$url.sha256" -o "$checksum_file"; then
-    echo "prebuilt checksum unavailable; continuing without sidecar verification" >&2
-    return 0
+    echo "prebuilt checksum unavailable; refusing unverified binary for $url" >&2
+    return 1
  fi
  expected="$(awk '{print $1}' "$checksum_file" | sed -n '1p')"
  actual="$(sha256_file "$archive")" || {