feat(install.sh): verify the checksum

CHANGELOG.md

@@ -7,6 +7,7 @@
 * feat: add database maintenance info with the new `database-maintenance-info` command ([PR#984](https://github.com/Scalingo/cli/pull/984))
 * feat: add database maintenance listing with the new `database-maintenance-list` command ([PR#982](https://github.com/Scalingo/cli/pull/982))
 * feat(addons): add maintenance windows manipulation with the new `addon-config` command ([PR#955](https://github.com/Scalingo/cli/pull/955))
+* feat(install.sh): verify the archive checksum ([PR#988](https://github.com/Scalingo/cli/pull/988))
 
 ### 1.29.1
 

dists/install.sh

@@ -119,7 +119,7 @@ main() {
 
   dirname="scalingo_${version}_${os}_${arch}"
   archive_name="${dirname}.${ext}"
-  url=https://github.com/Scalingo/cli/releases/download/${version}/${archive_name}
+  url="https://github.com/Scalingo/cli/releases/download/${version}/${archive_name}"
 
   status "Downloading Scalingo client...  "
   curl --silent --fail --location --output ${tmpdir}/${archive_name} ${url}
@@ -129,6 +129,20 @@ main() {
     exit 1
   fi
   echo "DONE"
+
+  status "Verifying the checksum...  "
+  checksums_url="https://github.com/Scalingo/cli/releases/download/${version}/checksums.txt"
+  checksum_computed=$(sha256sum ${tmpdir}/${archive_name} | cut -d " " -f1)
+  checksum_expected=$(wget -q --output-document - $checksums_url | grep $archive_name | cut -d " " -f 1)
+  if [[ "$checksum_computed" != "$checksum_expected" ]]; then
+    echo "INVALID"
+    error "Checksums don't match ('$checksum_computed' != '$checksum_expected').\n"
+    error "You may want to retry to install the Scalingo CLI. If the problem persists, please contact our support team.\n"
+    exit 1
+  fi
+  echo "VALID"
+  exit -1
+
   status "Extracting...   "
   tar -C "${tmpdir}" -x -f "${tmpdir}/${archive_name}"