Verify Downloaded Artifacts

Any CI/install workflow that downloads a binary or other external artifact must verify its integrity before use. Apply this standard: - Prefer immutable references (commit SHA/immutable artifact IDs) when your tooling supports it.

copy reviewer prompt

Prompt

Reviewer Prompt
Deploy Agent

Any CI/install workflow that downloads a binary or other external artifact must verify its integrity before use.

Apply this standard:

  • Prefer immutable references (commit SHA/immutable artifact IDs) when your tooling supports it.
  • Otherwise, download deterministically (e.g., by version/tag) and verify a pre-published cryptographic hash (sha256) at install time.
  • Fail closed: if the computed hash doesn’t match the expected hash, abort the install.

Example pattern (shell):

EXPECTED_SHA256="46847521abf3745686d89460809b84e6a9f10e33"  # trusted/pre-published
URL="https://example.com/tool/releases/download/vX.Y.Z/tool-linux-x64"
curl -fsSL "$URL" -o tool
ACTUAL_SHA256=$(sha256sum tool | awk '{print $1}')
if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
  echo "sha256 mismatch: expected $EXPECTED_SHA256 got $ACTUAL_SHA256" >&2
  exit 1
fi
# proceed to use tool only after verification

Source discussions