Skip to content

fix(obolup): fail closed on release-checksum verification failure #776

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bussyjd merged 1 commit into from
Jul 16, 2026
Merged

fix(obolup): fail closed on release-checksum verification failure #776

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 17 additions & 8 deletions obolup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,8 +519,10 @@ download_with_retries() {
}

# Verify a downloaded release binary against the published SHA256SUMS file.
# Fails (returns 1) on checksum mismatch. Warns and continues (returns 0) if
# SHA256SUMS is unavailable (older releases) or no local sha256 tool exists.
# Fails closed (returns 1) on checksum mismatch, a missing checksum entry, or
# no local sha256 tool. If SHA256SUMS itself can't be fetched, also fails
# closed unless OBOL_ALLOW_UNVERIFIED=1 is explicitly set, in which case the
# install proceeds unverified.
verify_release_checksum() {
local release_tag="$1"
local binary_name="$2"
Expand All @@ -530,8 +532,15 @@ verify_release_checksum() {
local tmp_sums="${binary_path}.sha256sums"

if ! download_with_retries "$sums_url" "$tmp_sums"; then
log_warn "SHA256SUMS not published for $release_tag, skipping checksum verification"
return 0
if [[ "${OBOL_ALLOW_UNVERIFIED:-}" == "1" || "${OBOL_ALLOW_UNVERIFIED:-}" == "true" ]]; then
log_warn "SHA256SUMS not published for $release_tag, skipping checksum verification (OBOL_ALLOW_UNVERIFIED set)"
return 0
fi
log_error "Could not fetch SHA256SUMS for $release_tag, refusing to install an unverified binary"
echo ""
echo " Set OBOL_ALLOW_UNVERIFIED=1 to bypass this check if you understand the risk."
echo ""
return 1
fi

# Match on the artifact name as published (e.g. obol_darwin_arm64),
Expand All @@ -541,14 +550,14 @@ verify_release_checksum() {
rm -f "$tmp_sums"

if [[ -z "$expected_hash" ]]; then
log_warn "No checksum entry for $binary_name in SHA256SUMS, skipping verification"
return 0
log_error "No checksum entry for $binary_name in SHA256SUMS ($release_tag), refusing to install an unverified binary"
return 1
fi

local actual_hash
if ! actual_hash=$(sha256_file "$binary_path"); then
log_warn "Neither sha256sum nor shasum is available, skipping checksum verification"
return 0
log_error "Neither sha256sum nor shasum is available, refusing to install an unverified binary"
return 1
fi

if [[ "$actual_hash" != "$expected_hash" ]]; then
Expand Down