Improve release and benchmark tooling

install.sh

@@ -217,10 +217,40 @@ install_extracted_binary() {
   install -m 0755 "$found" "$3"
 }
 
+sha256_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  elif command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$1" | awk '{print $1}'
+  else
+    return 1
+  fi
+}
+
+verify_archive_checksum() {
+  url="$1"
+  archive="$2"
+  checksum_file="$3"
+  if ! curl -fsL "$url.sha256" -o "$checksum_file"; then
+    echo "prebuilt checksum unavailable; continuing without sidecar verification" >&2
+    return 0
+  fi
+  expected="$(awk '{print $1}' "$checksum_file" | sed -n '1p')"
+  actual="$(sha256_file "$archive")" || {
+    echo "sha256sum/shasum not found for checksum verification" >&2
+    return 1
+  }
+  if [ "$expected" != "$actual" ]; then
+    echo "prebuilt checksum mismatch for $url" >&2
+    return 1
+  fi
+}
+
 try_install_prebuilt() {
   download_url="$(release_download_url)" || return 1
   tmpdir="$(mktemp -d)"
   archive="$tmpdir/$(release_artifact_name)"
+  checksum_file="$archive.sha256"
   [ "$quiet" = "1" ] && echo "Trying Dosh prebuilt $(release_artifact_name)"
   need curl
   need tar
@@ -228,6 +258,7 @@ try_install_prebuilt() {
     echo "prebuilt unavailable: $download_url" >&2
     return 1
   fi
+  verify_archive_checksum "$download_url" "$archive" "$checksum_file" || return 1
   mkdir -p "$tmpdir/extract"
   if ! tar -xzf "$archive" -C "$tmpdir/extract"; then
     echo "prebuilt archive could not be extracted: $download_url" >&2