fix(sec): enforce SHA256 verification in install.sh, remove silent skip paths#6191
Conversation
github-actions
Bot
added
area/docs
houko
left a comment
houko
left a comment
There was a problem hiding this comment.
The CHANGELOG entry is a single line with no description and no issue number, while every other entry in this section follows the convention **title** (#NNNN) (@author). Sentence one. Sentence two. The (@mrchn) attribution is present (good), but the entry needs at least: the issue number it fixes (if one exists), and 1–2 sentences explaining the security problem that was fixed (the old code silently skipped SHA256 verification when no hash tool was found; that was the actual vulnerability). Please expand the entry to match the project convention before merge.
Generated by Claude Code
35f2f82 to
ed2b6fd
Compare
github-actions
Bot
added
ready-for-review
…ay conflict markers
houko
left a comment
houko
left a comment
There was a problem hiding this comment.
LGTM — correctly closes the integrity-check bypass.
The script previously proceeded silently in two cases: the .sha256 file missing from the release, and no sha256sum/shasum in PATH. Both now exit 1 with a clear message instead of installing an unverified binary, and the actual hash-comparison path is unchanged. This is the right security/convenience tradeoff for an installer and matches what #6179 asked for. CI green. Approving.
2 participants
Two silent skip paths in the SHA256 verification block are now hard failures:
Checksum mismatch was already a hard failure and is unchanged.
Syntax verified with bash -n.