Require checksums for prebuilt installers

tests/release_scripts.rs

@@ -59,6 +59,25 @@ fn installers_skip_stale_latest_release_prebuilts() {
     );
 }
 
+#[test]
+fn installers_refuse_prebuilts_without_checksums() {
+    let install = include_str!("../install.sh");
+    assert!(install.contains("verify_archive_checksum"));
+    assert!(install.contains("refusing unverified binary for $url"));
+    assert!(
+        !install.contains("continuing without sidecar verification"),
+        "unix installer must not silently install an unverifiable prebuilt"
+    );
+
+    let ps1 = include_str!("../install.ps1");
+    assert!(ps1.contains("Verify-ArchiveChecksum"));
+    assert!(ps1.contains("refusing unverified binary for $Url"));
+    assert!(
+        !ps1.contains("continuing without sidecar verification"),
+        "windows installer must not silently install an unverifiable prebuilt"
+    );
+}
+
 #[test]
 fn package_check_verifies_only_artifacts_it_builds() {
     let makefile = include_str!("../Makefile");