Require checksums for prebuilt installers

install.ps1

@@ -185,8 +185,7 @@ function Verify-ArchiveChecksum($Url, $Archive) {
         Invoke-WebRequest -UseBasicParsing -Uri "$Url.sha256" -OutFile $checksumPath
     }
     catch {
-        Write-Warning "prebuilt checksum unavailable; continuing without sidecar verification"
-        return
+        throw "prebuilt checksum unavailable; refusing unverified binary for $Url"
     }
     $expected = ((Get-Content $checksumPath -Raw).Trim() -split "\s+")[0].ToLowerInvariant()
     $actual = (Get-FileHash -Algorithm SHA256 $Archive).Hash.ToLowerInvariant()

install.sh

@@ -330,8 +330,8 @@ verify_archive_checksum() {
   archive="$2"
   checksum_file="$3"
   if ! curl -fsL "$url.sha256" -o "$checksum_file"; then
-    echo "prebuilt checksum unavailable; continuing without sidecar verification" >&2
-    return 0
+    echo "prebuilt checksum unavailable; refusing unverified binary for $url" >&2
+    return 1
   fi
   expected="$(awk '{print $1}' "$checksum_file" | sed -n '1p')"
   actual="$(sha256_file "$archive")" || {

tests/release_scripts.rs

@@ -59,6 +59,25 @@ fn installers_skip_stale_latest_release_prebuilts() {
     );
 }
 
+#[test]
+fn installers_refuse_prebuilts_without_checksums() {
+    let install = include_str!("../install.sh");
+    assert!(install.contains("verify_archive_checksum"));
+    assert!(install.contains("refusing unverified binary for $url"));
+    assert!(
+        !install.contains("continuing without sidecar verification"),
+        "unix installer must not silently install an unverifiable prebuilt"
+    );
+
+    let ps1 = include_str!("../install.ps1");
+    assert!(ps1.contains("Verify-ArchiveChecksum"));
+    assert!(ps1.contains("refusing unverified binary for $Url"));
+    assert!(
+        !ps1.contains("continuing without sidecar verification"),
+        "windows installer must not silently install an unverifiable prebuilt"
+    );
+}
+
 #[test]
 fn package_check_verifies_only_artifacts_it_builds() {
     let makefile = include_str!("../Makefile");