Summary

• Generate SHA256 checksums for all release archives during CI build
• Publish .sha256 files alongside release artifacts
• Update install.sh to download and verify checksum before extraction
• Update install.ps1 to download and verify checksum before extraction
• Abort installation if checksum is missing or doesn't match

Security Impact

High - Prevents supply chain attacks via compromised downloads.

Changes

Release Workflow

• Added checksum generation step (Unix uses sha256sum/shasum, Windows uses Get-FileHash)
• Upload .sha256 files as release artifacts
• Include checksums in GitHub release assets

install.sh

• Added verify_checksum() function
• Downloads checksum file before extraction
• Verifies archive integrity using sha256sum or shasum
• Aborts if verification fails

install.ps1

• Added Test-Checksum function
• Downloads checksum file before extraction
• Verifies archive integrity using Get-FileHash
• Aborts if verification fails

Test plan

• Verify release workflow generates checksums correctly
• Test install.sh on Linux/macOS
• Test install.ps1 on Windows
• Verify installation aborts on checksum mismatch (manual test with corrupted file)

Closes #87