Add verified release installer

Author: RamazanKara

CHANGELOG.md

@@ -39,6 +39,7 @@
 - Added a public JSON Schema for evidence bundle manifests and test coverage that validates exported manifests against it.
 - Added `openexit verify-bundle` for offline evidence bundle verification with text and JSON reports.
 - Added `openexit release-manifest` and `openexit verify-release` for schema-backed release artifact manifests and offline binary/checksum verification.
+- Added a release installer script that detects the local platform, verifies the selected artifact against `SHA256SUMS` and `RELEASE_MANIFEST.json`, and is smoke-tested by the release gate.
 - Added `make release-check` and wired the draft-release workflow to run the full release gate before packaging artifacts.
 - Updated push CI to run the same release readiness gate, including smoke pipelines and bundle verification.
 - Updated CI and release workflows to Node.js 24-native GitHub Actions.

Makefile

@@ -13,7 +13,7 @@ EXAMPLE_INPUT ?= examples/datadog-to-grafana/input/datadog-fixture.json
 EXAMPLE_DIR ?= examples/datadog-to-grafana/output
 EXAMPLE_BUNDLE ?= examples/datadog-to-grafana/openexit-example.zip
 
-.PHONY: build test fmt fmt-check lint golangci-lint smoke example example-smoke verify release-dist release-check clean
+.PHONY: build test fmt fmt-check lint golangci-lint smoke example example-smoke verify release-dist install-smoke release-check clean
 
 build:
 	mkdir -p $(dir $(BINARY))
@@ -130,10 +130,19 @@ release-dist:
 	done
 	cd dist && sha256sum openexit_* > SHA256SUMS
 	$(GO) run -trimpath -ldflags "$(LDFLAGS)" ./cmd/openexit release-manifest --dist dist --out dist/$(RELEASE_MANIFEST) $(foreach target,$(PLATFORMS),--platform $(target))
+	cp scripts/install.sh dist/install.sh
+	chmod +x dist/install.sh
 
-release-check: verify release-dist
+install-smoke: release-dist
+	tmp=$$(mktemp -d); \
+	trap 'rm -rf "$$tmp"' EXIT; \
+	OPENEXIT_VERSION=$(VERSION) OPENEXIT_BASE_URL=$(CURDIR)/dist BIN_DIR="$$tmp/bin" sh scripts/install.sh; \
+	"$$tmp/bin/openexit" version | grep -q 'version: $(VERSION)'
+
+release-check: verify release-dist install-smoke
 	@test -s dist/SHA256SUMS
 	@test -s dist/$(RELEASE_MANIFEST)
+	@test -x dist/install.sh
 	@expected=$$(printf '%s\n' $(PLATFORMS) | wc -w | tr -d ' '); \
 	actual=$$(wc -l < dist/SHA256SUMS | tr -d ' '); \
 	if [ "$$actual" != "$$expected" ]; then \

README.md

@@ -25,6 +25,16 @@ make build
 
 `openexit demo` uses built-in redacted fixture data, runs the deterministic workflow, validates the output, and writes `./demo/openexit-demo.zip`.
 
+## Install Release Binary
+
+```bash
+curl -fsSL https://github.com/RamazanKara/openexit/releases/latest/download/install.sh | sh
+openexit doctor
+openexit demo ./demo
+```
+
+The installer detects Linux or macOS plus `amd64` or `arm64`, downloads the matching release binary, verifies it against `SHA256SUMS`, verifies that artifact against `RELEASE_MANIFEST.json`, and installs `openexit` into `/usr/local/bin` when writable or `~/.local/bin` otherwise. Set `OPENEXIT_VERSION=v0.1.0` for a specific release or `BIN_DIR=/path/to/bin` for a custom install location.
+
 ## Install From Source
 
 ```bash
@@ -77,7 +87,7 @@ make example VERSION=0.1.0-dev
 - `openexit export --project <project-dir> --format zip --out <file>`
 - `openexit verify-bundle <file> [--json]`
 - `openexit release-manifest [--dist dist --out dist/RELEASE_MANIFEST.json]`
-- `openexit verify-release <manifest.json> [--dist dist] [--require-checksums] [--json]`
+- `openexit verify-release <manifest.json> [--dist dist] [--artifact <name>] [--require-checksums] [--json]`
 - `openexit assist summarize --project <project-dir> --provider noop`
 
 The Datadog, GitHub, Okta, Auth0, Cloudflare, Akamai, OpenAI, and Anthropic collectors are read-only. API tokens are read from environment variables or local credential files, are not printed, and are not stored.
@@ -127,6 +137,7 @@ Included in the current implementation:
 - Offline evidence bundle verification for manifest schema, checksums, digest/size metadata, and archive path safety.
 - Release artifact manifest generation with per-binary OS/architecture metadata, size, and SHA-256 digests.
 - Offline release artifact verification against `RELEASE_MANIFEST.json` and optional `SHA256SUMS`.
+- Release installer script that selects the current platform binary and verifies it before installation.
 - Evidence bundle path-safety checks that reject symlinks in exported project sections.
 - No-op assist provider and explicit opt-in LiteLLM assist.
 - GitHub Enterprise to Forgejo assessment path with fixture import and live repository inventory collection.

docs/cli.md

@@ -37,7 +37,7 @@ The checked-in Datadog example can be refreshed with `make example VERSION=0.1.0
 
 `openexit release-manifest --dist dist --out dist/RELEASE_MANIFEST.json` writes a machine-readable manifest for release binaries. It records the stamped release version, commit, build date, generation time, and each expected OS/architecture artifact with file name, relative path, size, and SHA-256 digest. The manifest shape is published as `schemas/openexit.release-manifest.schema.json`.
 
-`openexit verify-release dist/RELEASE_MANIFEST.json --dist dist --require-checksums` verifies release binaries after download or before publishing. It validates the manifest schema, rejects unsafe artifact paths, recomputes file sizes and SHA-256 digests, and verifies `SHA256SUMS` when required. Use `--json` to feed the verification report into a release gate.
+`openexit verify-release dist/RELEASE_MANIFEST.json --dist dist --require-checksums` verifies release binaries after download or before publishing. It validates the manifest schema, rejects unsafe artifact paths, recomputes file sizes and SHA-256 digests, and verifies `SHA256SUMS` when required. Use repeatable `--artifact <name>` to verify only the current platform artifact after download, or `--json` to feed the verification report into a release gate.
 
 Generate individual artifacts with `openexit generate --artifact <name>`. The primary Datadog path supports `mapping`, `assessment`, `risk-register`, `manual-review`, `cost-drivers`, `target-architecture`, `acceptance-criteria`, `rollback-plan`, `runbook`, `restore-drill-checklist`, `alert-shadowing-plan`, `migration-plan`, `grafana-dashboards`, `prometheus-rules`, `opentelemetry`, and `argocd`. The GitHub Enterprise path also supports `forgejo-migration-candidate`; the identity path also supports `realm-client-candidate`; the edge path also supports `vcl-candidates`, `haproxy-candidates`, and `coraza-rule-candidates`; the AI provider path also supports `litellm-config-candidate`.
 

docs/release.md

@@ -21,6 +21,7 @@ Release-blocking v0.1 requirements:
 - Evidence bundle export with checksums, a schema-backed machine-readable manifest, and OpenExit version metadata.
 - Offline evidence bundle verification for archive path safety, manifest schema, manifest digests, and checksums.
 - Machine-readable release manifest generation and offline release artifact verification for OS/architecture binaries and `SHA256SUMS`.
+- Verified release installer for Linux/macOS `amd64` and `arm64` downloads.
 - No-op AI assist and optional external assist behind explicit opt-in.
 - Documentation, examples, CI, release draft workflow, and reproducible release artifacts.
 
@@ -37,11 +38,12 @@ The AI provider path is complete for local fixture assessment workflows and incl
 
 - [ ] `git status --short --branch` is clean and on the intended release branch.
 - [ ] GitHub Actions CI passes the same `make release-check VERSION=0.1.0-ci` gate used for local release readiness.
-- [ ] `make release-check VERSION=0.1.0` passes locally, including verification, CLI smoke pipelines, bundle verification, release artifact builds, and checksum count checks.
+- [ ] `make release-check VERSION=0.1.0` passes locally, including verification, CLI smoke pipelines, bundle verification, release artifact builds, installer smoke, and checksum count checks.
 - [ ] `make verify VERSION=0.1.0` passes, including CLI smoke pipelines.
 - [ ] `make lint` runs `gofmt`, `golangci-lint`, and `go vet`.
-- [ ] `make release-dist VERSION=0.1.0` produces binaries, `dist/SHA256SUMS`, and `dist/RELEASE_MANIFEST.json`.
+- [ ] `make release-dist VERSION=0.1.0` produces binaries, `dist/SHA256SUMS`, `dist/RELEASE_MANIFEST.json`, and `dist/install.sh`.
 - [ ] `openexit verify-release dist/RELEASE_MANIFEST.json --dist dist --require-checksums` passes and fails when a release binary is tampered with.
+- [ ] `OPENEXIT_VERSION=0.1.0 OPENEXIT_BASE_URL=$PWD/dist BIN_DIR=$(mktemp -d)/bin sh scripts/install.sh` installs a verified local release binary and `openexit version` reports `0.1.0`.
 - [ ] `make example VERSION=0.1.0-dev` refreshes `examples/datadog-to-grafana/output/` and exports `examples/datadog-to-grafana/openexit-example.zip`.
 - [ ] Datadog definition-of-done pipeline passes:
   `init`, `collect fixture`, `assess`, `map`, `generate --all`, `validate`, `export`.

internal/app/command.go

@@ -974,6 +974,7 @@ func newReleaseManifestCommand() *cobra.Command {
 
 func newVerifyReleaseCommand() *cobra.Command {
 	var distDir string
+	var artifacts []string
 	var jsonOutput, requireChecksums bool
 	cmd := &cobra.Command{
 		Use:   "verify-release <manifest.json>",
@@ -984,6 +985,7 @@ func newVerifyReleaseCommand() *cobra.Command {
 				ManifestPath:     args[0],
 				DistDir:          distDir,
 				RequireChecksums: requireChecksums,
+				Artifacts:        artifacts,
 			})
 			if jsonOutput {
 				enc := json.NewEncoder(cmd.OutOrStdout())
@@ -998,6 +1000,7 @@ func newVerifyReleaseCommand() *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVar(&distDir, "dist", "", "Release artifact directory; defaults to the manifest directory")
+	cmd.Flags().StringArrayVar(&artifacts, "artifact", nil, "Verify only a named artifact path; repeatable")
 	cmd.Flags().BoolVar(&requireChecksums, "require-checksums", false, "Require and verify SHA256SUMS alongside the manifest")
 	cmd.Flags().BoolVar(&jsonOutput, "json", false, "Write machine-readable release verification report")
 	return cmd

internal/app/e2e_test.go

@@ -178,6 +178,14 @@ func TestReleaseManifestAndVerifyCommands(t *testing.T) {
 		}
 	}
 
+	out, err = executeForTestWithOutput("verify-release", manifestPath, "--dist", distDir, "--require-checksums", "--artifact", manifest.Artifacts[0].Path)
+	if err != nil {
+		t.Fatalf("openexit verify-release --artifact failed: %v\n%s", err, out)
+	}
+	if !strings.Contains(out, "artifacts: 1") {
+		t.Fatalf("expected single-artifact verification, got:\n%s", out)
+	}
+
 	jsonOut, err := executeForTestWithOutput("verify-release", manifestPath, "--dist", distDir, "--require-checksums", "--json")
 	if err != nil {
 		t.Fatalf("openexit verify-release --json failed: %v\n%s", err, jsonOut)

internal/release/manifest.go

@@ -70,6 +70,7 @@ type VerifyOptions struct {
 	ManifestPath     string
 	DistDir          string
 	RequireChecksums bool
+	Artifacts        []string
 }
 
 type VerificationReport struct {
@@ -201,8 +202,13 @@ func Verify(opts VerifyOptions) (*VerificationReport, error) {
 	report.GeneratedAt = manifest.GeneratedAt
 
 	seen := map[string]struct{}{}
+	filters := artifactFilters(opts.Artifacts, report)
+	matchedFilters := map[string]struct{}{}
 	checksums := readChecksums(filepath.Join(distDir, ChecksumFileName), report, opts.RequireChecksums)
 	for _, artifact := range manifest.Artifacts {
+		if len(filters) > 0 && !artifactSelected(artifact, filters, matchedFilters) {
+			continue
+		}
 		result := ArtifactVerification{
 			Name:   artifact.Name,
 			OS:     artifact.OS,
@@ -222,11 +228,13 @@ func Verify(opts VerifyOptions) (*VerificationReport, error) {
 			resultError(&result, "duplicate artifact path")
 		}
 		seen[artifact.Path] = struct{}{}
+		actualDigest := ""
 		if result.Status == "passed" {
 			info, digest, err := fileDigest(filepath.Join(distDir, filepath.FromSlash(artifact.Path)))
 			if err != nil {
 				resultError(&result, err.Error())
 			} else {
+				actualDigest = digest
 				if info.Size() != artifact.Size {
 					resultError(&result, "size mismatch")
 				}
@@ -241,6 +249,8 @@ func Verify(opts VerifyOptions) (*VerificationReport, error) {
 				resultError(&result, "missing SHA256SUMS entry")
 			} else if digest != artifact.SHA256 {
 				resultError(&result, "SHA256SUMS digest mismatch")
+			} else if actualDigest != "" && digest != actualDigest {
+				resultError(&result, "SHA256SUMS digest mismatch")
 			}
 		}
 		if result.Status != "passed" {
@@ -250,6 +260,23 @@ func Verify(opts VerifyOptions) (*VerificationReport, error) {
 		}
 		report.Artifacts = append(report.Artifacts, result)
 	}
+	if len(filters) > 0 {
+		for filter := range filters {
+			if _, ok := matchedFilters[filter]; !ok {
+				reportError(report, "manifest has no artifact "+filter)
+			}
+		}
+	}
+	if len(report.Artifacts) == 0 {
+		reportError(report, "manifest has no artifacts to verify")
+	}
+	if checksums != nil && len(filters) == 0 {
+		for rel := range checksums {
+			if _, ok := seen[rel]; !ok {
+				reportError(report, "SHA256SUMS entry not present in manifest "+rel)
+			}
+		}
+	}
 	return finishReport(report)
 }
 
@@ -337,17 +364,40 @@ func readChecksums(path string, report *VerificationReport, require bool) map[st
 			reportError(report, "duplicate SHA256SUMS entry "+rel)
 			continue
 		}
-		_, actual, err := fileDigest(filepath.Join(filepath.Dir(path), filepath.FromSlash(rel)))
-		if err != nil {
-			reportError(report, "SHA256SUMS "+rel+": "+err.Error())
+		checksums[rel] = digest
+	}
+	return checksums
+}
+
+func artifactFilters(artifacts []string, report *VerificationReport) map[string]struct{} {
+	if len(artifacts) == 0 {
+		return nil
+	}
+	filters := map[string]struct{}{}
+	for _, artifact := range artifacts {
+		artifact = strings.TrimSpace(artifact)
+		if artifact == "" {
+			reportError(report, "empty artifact filter")
+			continue
+		}
+		if err := safeArtifactPath(artifact); err != nil {
+			reportError(report, "artifact filter "+artifact+": "+err.Error())
 			continue
 		}
-		if actual != digest {
-			reportError(report, "SHA256SUMS digest mismatch for "+rel)
+		filters[artifact] = struct{}{}
+	}
+	return filters
+}
+
+func artifactSelected(artifact Artifact, filters, matched map[string]struct{}) bool {
+	selected := false
+	for _, candidate := range []string{artifact.Path, artifact.Name} {
+		if _, ok := filters[candidate]; ok {
+			matched[candidate] = struct{}{}
+			selected = true
 		}
-		checksums[rel] = digest
 	}
-	return checksums
+	return selected
 }
 
 func safeArtifactPath(rel string) error {

internal/release/manifest_test.go

@@ -84,6 +84,56 @@ func TestVerifyManifestRejectsTamperedArtifact(t *testing.T) {
 	}
 }
 
+func TestVerifyManifestCanCheckSingleArtifactSubset(t *testing.T) {
+	distDir := t.TempDir()
+	version := "1.2.3"
+	linux := ArtifactName(version, "linux", "amd64")
+	windows := ArtifactName(version, "windows", "amd64")
+	writeArtifact(t, distDir, linux, "linux binary")
+	writeArtifact(t, distDir, windows, "windows binary")
+	manifest, err := Generate(ManifestOptions{
+		DistDir:   distDir,
+		Version:   version,
+		Commit:    "abc123",
+		Date:      "2026-05-27T00:00:00Z",
+		Platforms: []string{"linux/amd64", "windows/amd64"},
+	})
+	if err != nil {
+		t.Fatalf("generate manifest: %v", err)
+	}
+	manifestPath := filepath.Join(distDir, DefaultManifest)
+	if err := Write(manifestPath, manifest); err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+	if err := writeSHA256SUMS(distDir, manifest.Artifacts); err != nil {
+		t.Fatalf("write checksums: %v", err)
+	}
+	if err := os.Remove(filepath.Join(distDir, windows)); err != nil {
+		t.Fatal(err)
+	}
+
+	report, err := Verify(VerifyOptions{
+		ManifestPath:     manifestPath,
+		DistDir:          distDir,
+		RequireChecksums: true,
+		Artifacts:        []string{linux},
+	})
+	if err != nil {
+		t.Fatalf("verify filtered release: %v", err)
+	}
+	if report.Status != "passed" || len(report.Artifacts) != 1 || report.Artifacts[0].Path != linux {
+		t.Fatalf("unexpected filtered verification report: %+v", report)
+	}
+
+	report, err = Verify(VerifyOptions{ManifestPath: manifestPath, DistDir: distDir, RequireChecksums: true})
+	if err == nil {
+		t.Fatalf("expected full verification to fail after removing artifact, got %+v", report)
+	}
+	if !strings.Contains(strings.Join(report.Errors, "\n"), windows) {
+		t.Fatalf("expected missing windows artifact error, got %+v", report.Errors)
+	}
+}
+
 func writeArtifact(t *testing.T, distDir, name, content string) {
 	t.Helper()
 	if err := os.WriteFile(filepath.Join(distDir, name), []byte(content), 0o755); err != nil {