Introduce checksum verification of downloads

 - Add central checksums dir
 - shvr_fetch verification
 - check by default, SHVR_SKIP_VERIFY_SHA256=1 to skip
 - Replace direct downloads with shvr_fetch
 - Added CI flow to ensure checksum verification works
 - README updates

Author: alganet

.github/workflows/docker-all.yml

@@ -16,6 +16,7 @@ jobs:
   build:
     needs: download
     runs-on: ubuntu-24.04
+
     continue-on-error: ${{ matrix.can_fail_build }}
     steps:
       - uses: actions/checkout@v3

.github/workflows/docker-latest.yml

@@ -16,6 +16,7 @@ jobs:
   build:
     needs: download
     runs-on: ubuntu-24.04
+
     continue-on-error: ${{ matrix.can_fail_build }}
     steps:
       - uses: actions/checkout@v3

.github/workflows/docker-test.yml

@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: ISC
 
 name: Push alganet/shell-versions:test
+permissions:
+  contents: read
 
 on:
   pull_request:
@@ -16,6 +18,7 @@ jobs:
   build:
     needs: download
     runs-on: ubuntu-24.04
+
     continue-on-error: ${{ matrix.can_fail_build }}
     steps:
       - uses: actions/checkout@v3

.github/workflows/test-verification.yml

@@ -0,0 +1,60 @@
+name: Checksum Verification
+
+on:
+  pull_request:
+    branches: [ main ]
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  verify-checksums:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: 'Fast verify: successful download (dash)'
+        run: |
+          set -ex
+          # ensure clean state and perform an initial download (should succeed)
+          rm -f build/dash/0.5.13.tar.gz
+          sh shvr.sh download dash_0.5.13
+
+      - name: 'Corrupt checksum and assert download fails'
+        run: |
+          set -ex
+          # backup checksum file
+          cp checksums/dash/0.5.13.tar.gz.sha256sums checksums/dash/0.5.13.tar.gz.sha256sums.bak
+          # corrupt checksum: replace hash with ones; keep filename
+          printf '1111111111111111111111111111111111111111111111111111111111111111  %s\n' "0.5.13.tar.gz" > checksums/dash/0.5.13.tar.gz.sha256sums
+          # remove any existing artifact to force re-download
+          rm -f build/dash/0.5.13.tar.gz
+          set +e
+          # attempt download once; if the worker network is flaky this may fail
+          # for reasons other than checksum mismatch. Capture logs and RC so we
+          # can differentiate mismatch from other failures.
+          # run the download and capture the exit code; write logs to file
+          sh shvr.sh download dash_0.5.13 > download.log 2>&1
+          rc=$?
+          # show the log to the step output so it appears in CI
+          cat download.log
+          set -e
+          if [ "$rc" -eq 0 ]; then
+            echo "Expected checksum verification to fail but it succeeded" >&2
+            exit 1
+          fi
+          # ensure the failure was due to checksum mismatch; depending on the
+          # runner and sha256sum version we may see one of multiple messages:
+          # - our own 'sha256sum mismatch for ...' message
+          # - a 'filename: FAILED' message emitted by 'sha256sum -c'
+          # If neither is present then this is likely a transient network or
+          # download tool error; fail the CI with the full log to help debug.
+          grep -q "sha256sum mismatch" download.log || grep -q ": FAILED" download.log || (cat download.log && exit 1)
+
+      - name: 'Restore checksum and verify success'
+        run: |
+          set -ex
+          mv checksums/dash/0.5.13.tar.gz.sha256sums.bak checksums/dash/0.5.13.tar.gz.sha256sums
+          rm -f build/dash/0.5.13.tar.gz
+          sh shvr.sh download dash_0.5.13

Dockerfile

@@ -7,11 +7,13 @@ FROM debian:bookworm-slim AS builder
     RUN apt-get -y update
 
     # Copy contents
-    COPY "shvr.sh" "/shvr/shvr.sh"
-    COPY "variants/" "/shvr/variants"
+    COPY "build/" "/usr/src/shvr"
+    COPY "checksums/" "/shvr/checksums"
     COPY "common/" "/shvr/common"
     COPY "patches/" "/shvr/patches"
-    COPY "build/" "/usr/src/shvr"
+    COPY "variants/" "/shvr/variants"
+
+    COPY "shvr.sh" "/shvr/shvr.sh"
     RUN chmod +x "/shvr/shvr.sh"
 
     # Setup environment

README.md

@@ -0,0 +1 @@
+bf7a055e0916b7899e7429e36e35d009db445b942b34520a601ea5a8fa634fdd  001

checksums/bash/2.05b-patches/001.sha256sums

@@ -0,0 +1 @@
+affdd1808a6262fbfe291ebffa2133b05e4bb46067a90e3329d5741e10f0587b  002

checksums/bash/2.05b-patches/002.sha256sums

@@ -0,0 +1 @@
+604972eaafe69f44413d429e0a826b0eae209ca74b14eeeccdf0d502bbabb340  003

checksums/bash/2.05b-patches/003.sha256sums

@@ -0,0 +1 @@
+fab91e9742ca4e990666441e91821742e6dff78e8e388ba55205cf7b1cd8e8e1  004