Verify the downloaded .deb against its release asset digest (#18)

The released .deb runs a postinst that patches binaries but was fetched
over TLS only, with no integrity check. install.sh now verifies the
download against its GitHub release asset digest (per-asset sha256;
releases are immutable) before apt-get install. A mismatch aborts — and
so does a missing digest, which can't legitimately occur since
install.sh only ever resolves the latest release, which always carries
one; failing closed keeps the check from being bypassed by stripping the
field.

Release-JSON parsing lives in pure asset_url / asset_digest helpers
(grep/sed, since jq is only pulled in later as a package dependency),
with the digest bound to the same .deb asset asset_url selects. The
helpers are unit-tested hermetically via shUnit2 (test/install_test.sh,
the test:shunit2 suite under mise run test:fast).

Co-authored-by: sturq <81992095+sturq@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sturq

install.sh

@@ -38,6 +38,26 @@ asset_url() {
     sed -E 's/.*"(https[^"]+)"$/\1/'
 }
 
+# Extract the aarch64 .deb asset's sha256 digest from GitHub release JSON ($1).
+# Digests are per-asset, so bind to the same asset asset_url picks rather than
+# grabbing the first digest in the document: flatten newlines, split the asset
+# array into one object per line, select the .deb object by its URL, then read
+# that object's digest. grep/sed, not jq (only pulled in later as a package
+# dependency). GitHub records a sha256 for every asset and this repo's releases
+# are immutable, so it can't change after publish. `|| true` tolerates a
+# no-match; an absent digest makes main abort (it only fetches the latest
+# release, which always carries one).
+asset_digest() {
+  printf '%s' "$1" |
+    tr '\n' ' ' |
+    sed -E 's/\}[[:space:]]*,[[:space:]]*\{/}\n{/g' |
+    { grep -E '"browser_download_url"[[:space:]]*:[[:space:]]*"[^"]*_aarch64\.deb"' || true; } |
+    head -1 |
+    { grep -oE '"digest"[[:space:]]*:[[:space:]]*"sha256:[0-9a-f]{64}"' || true; } |
+    head -1 |
+    sed -E 's/.*"sha256:([0-9a-f]{64})".*/\1/'
+}
+
 main() {
   set -euo pipefail
 
@@ -52,7 +72,7 @@ main() {
     log "Installing local package $deb"
   else
     log "Resolving the latest release of $REPO…"
-    local api url
+    local api url digest actual
     api=$(curl -fsSL "$API") ||
       die "could not reach the GitHub API (network down or rate limited)."
     url=$(asset_url "$api")
@@ -62,6 +82,20 @@ main() {
     trap 'rm -f -- "$deb"' EXIT
     log "Downloading $url"
     curl -fsSL "$url" -o "$deb"
+
+    # Verify the download against the release asset's digest before install,
+    # since the .deb runs a postinst that patches binaries. A missing digest
+    # aborts too: install.sh only fetches the latest release, which always
+    # carries one, so its absence means tampered or unexpected metadata — not a
+    # legitimately undigested asset — and skipping the check would defeat it.
+    digest=$(asset_digest "$api")
+    [ -n "$digest" ] ||
+      die "no sha256 digest for $(basename "$url") in the release metadata; refusing to install unverified."
+    log "Verifying checksum…"
+    actual=$(sha256sum "$deb" | cut -d' ' -f1)
+    [ "$actual" = "$digest" ] ||
+      die "checksum mismatch for $(basename "$url"): expected $digest, got $actual."
+    log "Checksum OK."
   fi
 
   # glibc-runner and patchelf-glibc live in the glibc-packages repo, which the

test/install_test.sh

@@ -19,19 +19,22 @@ cd "$(dirname "$0")/.." || exit 1
 # shellcheck source=/dev/null
 CLAUDE_CODE_INSTALL_LIB=1 . ./install.sh
 
-# A release-JSON shape mirroring GitHub's, with a decoy asset before the aarch64
-# .deb so the selector has to discriminate rather than grab the first URL.
+# A release-JSON shape mirroring GitHub's, with a decoy asset (no .deb suffix,
+# its own distinct digest) ordered before the aarch64 .deb so the selectors must
+# discriminate by asset — not just grab the first url/digest in the document.
 release_json() {
   cat <<'EOF'
 {
   "assets": [
     {
-      "name": "SHA256SUMS",
-      "browser_download_url": "https://github.com/gtbuchanan/claude-code-termux/releases/download/v2026.6.19/SHA256SUMS"
+      "name": "release-notes.txt",
+      "browser_download_url": "https://github.com/gtbuchanan/claude-code-termux/releases/download/v2026.6.19/release-notes.txt",
+      "digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
     },
     {
       "name": "claude-code-termux_2026.6.19_aarch64.deb",
-      "browser_download_url": "https://github.com/gtbuchanan/claude-code-termux/releases/download/v2026.6.19/claude-code-termux_2026.6.19_aarch64.deb"
+      "browser_download_url": "https://github.com/gtbuchanan/claude-code-termux/releases/download/v2026.6.19/claude-code-termux_2026.6.19_aarch64.deb",
+      "digest": "sha256:6c5280d0a9fa52138097035b298e03fcb40e61001350a3492a8d70c35b2805a8"
     }
   ]
 }
@@ -44,27 +47,39 @@ test_asset_url_extracts_aarch64_deb() {
     "$(asset_url "$(release_json)")"
 }
 
-# Run asset_url under pipefail — as main() does — and assert it yields no output
-# AND still exits 0. This is what proves the `|| true` guard: without it, the
-# no-match grep's non-zero status would trip pipefail and abort the install.
-assert_no_match_under_pipefail() { # $1 = message, $2 = release JSON
+test_asset_digest_extracts_sha256() {
+  assertEquals 'extracts the .deb asset sha256 digest (bare hex, no prefix)' \
+    '6c5280d0a9fa52138097035b298e03fcb40e61001350a3492a8d70c35b2805a8' \
+    "$(asset_digest "$(release_json)")"
+}
+
+# Run helper $1 (asset_url|asset_digest) on JSON $3 under pipefail — as main()
+# does — and assert no output AND a 0 exit. Empty-with-success is what proves
+# the `|| true` guard: without it the no-match grep's non-zero status would trip
+# pipefail and abort the install.
+assert_empty_under_pipefail() { # $1 = helper, $2 = message, $3 = release JSON
   local out rc
   out="$(
     set -o pipefail
-    asset_url "$2"
+    "$1" "$3"
   )"
   rc=$?
-  assertEquals "$1" '' "$out"
-  assertEquals "$1 (exits 0 under pipefail)" 0 "$rc"
+  assertEquals "$2" '' "$out"
+  assertEquals "$2 (exits 0 under pipefail)" 0 "$rc"
 }
 
 test_asset_url_empty_when_no_aarch64_deb() {
-  assert_no_match_under_pipefail 'empty when the release has no aarch64 .deb asset' \
+  assert_empty_under_pipefail asset_url 'empty when the release has no aarch64 .deb asset' \
     '{"assets":[{"browser_download_url":"https://example.com/x.txt"}]}'
 }
 
 test_asset_url_empty_on_non_json() {
-  assert_no_match_under_pipefail 'empty on a non-JSON blob' 'this is not json'
+  assert_empty_under_pipefail asset_url 'empty on a non-JSON blob' 'this is not json'
+}
+
+test_asset_digest_empty_when_absent() {
+  assert_empty_under_pipefail asset_digest 'empty when the .deb asset has no digest' \
+    '{"assets":[{"browser_download_url":"https://example.com/x_aarch64.deb"}]}'
 }
 
 # shUnit2 hands control here: it discovers the test_* functions above and prints