ci: verify Hysteria2 binary SHA256 against official hashes.txt

Author: hawkff

buildScript/lib/hysteria2.sh

@@ -16,11 +16,31 @@ BASE="https://github.com/apernet/hysteria/releases/download/app/${HYSTERIA_VERSI
 
 OUT="$(pwd)/app/executableSo"
 
+# Fetch the official checksums once for integrity verification.
+HASHES="$(curl -fsSL "$BASE/hashes.txt")"
+
+sha256_tool() {
+  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | awk '{print $1}'
+  else shasum -a 256 "$1" | awk '{print $1}'; fi
+}
+
 dl() {
   local abi="$1" asset="$2"
   echo ">> downloading libhysteria2.so for $abi ($asset)"
   mkdir -p "$OUT/$abi"
   curl -fL "$BASE/$asset" -o "$OUT/$abi/libhysteria2.so"
+  # Verify against the official SHA256 (hashes.txt lines: "<sha>  build/<asset>").
+  local expected actual
+  expected="$(printf '%s\n' "$HASHES" | awk -v a="build/$asset" '$2==a {print $1}')"
+  if [ -z "$expected" ]; then
+    echo "Error: no checksum for $asset in hashes.txt" >&2
+    exit 1
+  fi
+  actual="$(sha256_tool "$OUT/$abi/libhysteria2.so")"
+  if [ "$expected" != "$actual" ]; then
+    echo "Error: checksum mismatch for $asset (expected $expected, got $actual)" >&2
+    exit 1
+  fi
   chmod +x "$OUT/$abi/libhysteria2.so"
 }