Summary
install.sh (lines 721-748) verifies the release archive only by SHA256 checksum fetched from the same hosting infrastructure. An attacker who controls the release mirror, achieves DNS hijacking, or compromises the CDN can replace both the archive and the sha256sums.txt together — the checksum check then validates the malicious pair. There is no GPG signature verification, no signed manifest, and no out-of-band trust anchor.
Where
install.sh:721-748 (archive verification block)
Suggested approach
(1) Publish a sha256sums.txt.asc GPG-signed manifest alongside each release and include the maintainer's public key fingerprint in the README. (2) In install.sh, after the SHA check, run gpg --verify sha256sums.txt.asc sha256sums.txt when gpg is available; if absent, print a clear "warning: signature verification skipped, gpg not installed" line and continue (do not fail-closed, to keep the no-gpg path working). (3) Alternative: use cosign verify-blob against a transparency-logged signature for keyless verification. (4) Add a --strict-verify flag and CDIDX_STRICT_VERIFY=1 env to refuse install when signature verification cannot be performed. (5) Document under "Installation security".
Summary
install.sh(lines 721-748) verifies the release archive only by SHA256 checksum fetched from the same hosting infrastructure. An attacker who controls the release mirror, achieves DNS hijacking, or compromises the CDN can replace both the archive and thesha256sums.txttogether — the checksum check then validates the malicious pair. There is no GPG signature verification, no signed manifest, and no out-of-band trust anchor.Where
install.sh:721-748(archive verification block)Suggested approach
(1) Publish a
sha256sums.txt.ascGPG-signed manifest alongside each release and include the maintainer's public key fingerprint in the README. (2) Ininstall.sh, after the SHA check, rungpg --verify sha256sums.txt.asc sha256sums.txtwhengpgis available; if absent, print a clear "warning: signature verification skipped, gpg not installed" line and continue (do not fail-closed, to keep the no-gpg path working). (3) Alternative: usecosign verify-blobagainst a transparency-logged signature for keyless verification. (4) Add a--strict-verifyflag andCDIDX_STRICT_VERIFY=1env to refuse install when signature verification cannot be performed. (5) Document under "Installation security".