Skip to content

fix(install): prefer shasum on macOS to avoid BSD sha256sum incompatibility#34

Merged
canoo merged 1 commit intocanoo:mainfrom
anakinMango:fix/macos-sha256sum-checksum
Apr 24, 2026
Merged

fix(install): prefer shasum on macOS to avoid BSD sha256sum incompatibility#34
canoo merged 1 commit intocanoo:mainfrom
anakinMango:fix/macos-sha256sum-checksum

Conversation

@anakinMango
Copy link
Copy Markdown
Collaborator

@anakinMango anakinMango commented Apr 24, 2026 •
edited by coderabbitai Bot
Loading

Problem

Closes #33

install.sh fails on macOS at checksum verification:

==> Verifying checksum...
usage: sha256sum [-bctwz] [files ...]
  ✗ Checksum verification failed — binary may be corrupted or tampered with

macOS ships a BSD sha256sum that does not support --check or --status (GNU coreutils flags). Since command -v sha256sum succeeds on macOS, the shasum fallback is never reached.

Fix

Use the $OS variable (already set by detect_platform) to prefer shasum -a 256 on darwin, then fall back to sha256sum on Linux, with shasum as a final fallback. Also consolidates the duplicated expected hash extraction into a single block.

Tested

  • macOS arm64: checksum verification now passes using shasum -a 256
  • Linux behavior unchanged (sha256sum path still taken)

Summary by CodeRabbit

  • Refactor
    • Installation process checksum verification has been refined for better reliability and maintainability. Error handling is now consolidated with clearer feedback when verification fails. Cross-platform tool selection has been optimized to ensure consistent and secure binary installation across all supported operating systems.

@canoo
fix(install): prefer shasum on macOS to avoid BSD sha256sum incompati…
3e0c980 
…bility

BSD sha256sum on macOS does not support --check/--status flags (GNU only).
Use $OS (already set by detect_platform) to prefer shasum -a 256 on darwin,
falling back to sha256sum on Linux and shasum as a final fallback.

Fixes canoo#33
@anakinMango anakinMango requested a review from canoo as a code owner April 24, 2026 21:37
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Apr 24, 2026 •
edited
Loading

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4f6610df-b359-4e58-b96d-92e3c0941b26

📥 Commits

Reviewing files that changed from the base of the PR and between 5249ac1 and 3e0c980.

📒 Files selected for processing (1)
  • install.sh
📝 Walkthrough

Walkthrough

The checksum verification logic in install.sh's download_binary() function is refactored to extract the expected hash once via awk, consolidate missing checksum error handling, and implement OS-aware tool selection that prefers shasum -a 256 on macOS and sha256sum on Linux.

Changes

Cohort / File(s) Summary
Checksum Verification Refactor
install.sh		 Reorganized checksum extraction and verification tool selection to first extract the expected hash, then select the appropriate hashing tool based on OS (darwin prefers shasum -a 256, Linux uses sha256sum, with shasum as fallback). Consolidated missing checksum entry error handling into a single guard outside tool-specific branches.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

Suggested reviewers

  • canoo

Poem

🐰 The binary hops onto macOS with glee,
shasum now checks what sha256 couldn't see,
Darwin and Linux both play their part,
One script, one hash, one true beating heart! 💚

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: addressing macOS SHA256 checksum verification by preferring shasum to avoid BSD incompatibility.
Linked Issues check ✅ Passed The pull request fully addresses issue #33 requirements: uses $OS to prefer shasum on darwin, falls back to sha256sum on Linux, and consolidates hash extraction logic.
Out of Scope Changes check ✅ Passed All changes in install.sh directly address the macOS checksum verification issue with no unrelated modifications introduced.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

canoo
canoo approved these changes Apr 24, 2026
View reviewed changes
Copy link
Copy Markdown
Owner

@canoo canoo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean fix. Deduplicating the hash extraction and using $OS to prefer shasum on darwin is the right approach. BSD sha256sum lacking --check/--status is a real cross-platform issue.

@canoo canoo merged commit 1f3eb6d into canoo:main Apr 24, 2026
4 checks passed
This was referenced Apr 28, 2026
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@canoo canoo canoo approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

install.sh: checksum verification fails on macOS due to BSD sha256sum incompatibility

2 participants

@anakinMango @canoo