fix: verify stable release checksums

1 files changed, 36 insertions, 0 deletions

diff --git a/website/install.sh b/website/install.sh
index 81c583ac..4e3ce40d 100755
--- a/website/install.sh
+++ b/website/install.sh
@@ -50,11 +50,38 @@ main() {
             exit
         }
     ')"
+    SHA256="$(printf '%s\n' "$MANIFEST" | awk -v target="\"${TARGET}\"" '
+        /^[[:space:]]*"sha256"[[:space:]]*:/ { in_sha256 = 1; next }
+        in_sha256 && /^[[:space:]]*}/ { exit }
+        in_sha256 && index($0, target) {
+            sub(/^.*:[[:space:]]*"/, "")
+            sub(/".*$/, "")
+            print
+            exit
+        }
+    ')"
     VERSION="$(printf '%s\n' "$MANIFEST" | awk -F '"' '/^[[:space:]]*"version"[[:space:]]*:/ { print $4; exit }')"
 
     if [ -z "$URL" ]; then
         err "release manifest does not include a binary for ${TARGET}"
     fi
+    if [ "${#SHA256}" -ne 64 ]; then
+        err "release manifest does not include a valid SHA-256 checksum for ${TARGET}"
+    fi
+    if ! printf '%s\n' "$SHA256" | awk '/[^0-9A-Fa-f]/ { exit 1 }'; then
+        err "release manifest does not include a valid SHA-256 checksum for ${TARGET}"
+    fi
+    SHA256="$(printf '%s\n' "$SHA256" | awk '{ print tolower($0) }')"
+
+    if command -v sha256sum >/dev/null 2>&1; then
+        SHA256_TOOL="sha256sum"
+    elif command -v shasum >/dev/null 2>&1; then
+        SHA256_TOOL="shasum"
+    elif command -v openssl >/dev/null 2>&1; then
+        SHA256_TOOL="openssl"
+    else
+        err "SHA-256 verification requires sha256sum, shasum, or openssl"
+    fi
 
     if [ -n "$VERSION" ]; then
         log "downloading v${VERSION}..."
@@ -68,6 +95,15 @@ main() {
         err "download failed from ${URL}"
     fi
 
+    case "$SHA256_TOOL" in
+        sha256sum) ACTUAL_SHA256="$(sha256sum < "${TMP}/${BIN}" | awk '{ print $1 }')" ;;
+        shasum)    ACTUAL_SHA256="$(shasum -a 256 < "${TMP}/${BIN}" | awk '{ print $1 }')" ;;
+        openssl)   ACTUAL_SHA256="$(openssl dgst -sha256 < "${TMP}/${BIN}" | awk '{ print $NF }')" ;;
+    esac
+    if [ "$ACTUAL_SHA256" != "$SHA256" ]; then
+        err "downloaded Herdr checksum did not match"
+    fi
+
     # install
     mkdir -p "$INSTALL_DIR"
     mv "${TMP}/${BIN}" "${INSTALL_DIR}/${BIN}"