mirror of
https://github.com/hanzoai/dev.git
synced 2026-10-17 15:34:54 +00:00
zeekayandHanzo Dev
c58a31887c
postinstall downloads a binary from a release and executes it. Until now the only check on those bytes was the file magic — proof that they are an executable, not proof that they are ours. Every release asset already ships a sibling .sha256; read it and compare. The per-user cache is keyed by version number alone, so a binary of unknown provenance sitting under an already-cached version survived every reinstall. A cache entry is now trusted only while a stamp beside it still matches its bytes, and the stamp is written after the published checksum verified the archive it came from — so a cache hit carries that proof forward. Verified against v0.6.100: a tampered cached binary is refused, re-downloaded, checked and repaired. Co-authored-by: Hanzo Dev <[email protected]>