Summary
install.sh fetches both the binary tarball and the sha256sums.txt file from the same GitHub release URL. If an attacker can replace the release artifacts (compromised maintainer account, compromised release PAT, GitHub infrastructure compromise), they can replace the binary and the matching checksum in one operation — the chain provides no independent trust anchor. A second-channel checksum source (signed git tag, separately-hosted manifest, transparency log) would let the install script verify integrity even if the GitHub release is compromised.
Where
install.sh:712,724,729 (binary and checksum fetched from same release URL)
Suggested approach
(1) Once attestations land (see related signing issue), have install.sh verify provenance via gh attestation verify instead of (or in addition to) sha256 comparison. (2) Alternatively, publish sha256sums.txt to a separate, signed source — e.g., commit it to the repo on tag, and have install.sh fetch from raw.githubusercontent.com at the tag commit (signed). (3) Document the threat model and chosen mitigation in USER_GUIDE.md.
Summary
install.shfetches both the binary tarball and thesha256sums.txtfile from the same GitHub release URL. If an attacker can replace the release artifacts (compromised maintainer account, compromised release PAT, GitHub infrastructure compromise), they can replace the binary and the matching checksum in one operation — the chain provides no independent trust anchor. A second-channel checksum source (signed git tag, separately-hosted manifest, transparency log) would let the install script verify integrity even if the GitHub release is compromised.Where
install.sh:712,724,729(binary and checksum fetched from same release URL)Suggested approach
(1) Once attestations land (see related signing issue), have
install.shverify provenance viagh attestation verifyinstead of (or in addition to) sha256 comparison. (2) Alternatively, publishsha256sums.txtto a separate, signed source — e.g., commit it to the repo on tag, and have install.sh fetch fromraw.githubusercontent.comat the tag commit (signed). (3) Document the threat model and chosen mitigation inUSER_GUIDE.md.