From b765cca0ed8b14e4f478909e7fb07f87cd570945 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Fri, 7 Aug 2026 11:26:35 +0000
Subject: [PATCH] fix(P17): install.sh checksum verification (REQ-132, F14)

---ci---
project: orca
phase: 17
milestone: v0.12
status: execute
---/ci---

install.sh now fetches SHA256SUMS from the release and verifies the
tarball checksum before extraction. Fail closed on mismatch. Warns
if SHA256SUMS is absent (insecure). Build green.
---
 scripts/install.sh | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/scripts/install.sh b/scripts/install.sh
index 425c845..3f90295 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -36,6 +36,10 @@ CHECK=false
 INSTALL_BIN=""
 NAMESPACE_DIR=""
 
+warn() {
+  printf "  \033[1;33m!\033[0m %s\n" "$*" >&2
+}
+
 err()  { echo "install: error: $*" >&2; exit 1; }
 info() { echo "install: $*"; }
 
@@ -173,6 +177,19 @@ trap 'rm -rf "$TMPDIR"' EXIT
 info "downloading..."
 curl -fsSL -o "${TMPDIR}/${TARBALL}" "$ASSET_URL"
 
+# REQ-132 / F14: verify tarball checksum before extraction.
+# Fetch SHA256SUMS from the same release; fail closed on mismatch.
+SHA256SUMS_URL="$(dirname "$ASSET_URL")/SHA256SUMS"
+if curl -fsSL -o "${TMPDIR}/SHA256SUMS" "$SHA256SUMS_URL" 2>/dev/null; then
+  info "verifying checksum..."
+  (cd "$TMPDIR" && grep -F "$TARBALL" SHA256SUMS | sha256sum -c -) || {
+    err "checksum verification failed (REQ-132); refusing to install"
+    exit 1
+  }
+else
+  warn "no SHA256SUMS found at $SHA256SUMS_URL; skipping checksum (insecure)"
+fi
+
 info "extracting..."
 tar -xzf "${TMPDIR}/${TARBALL}" -C "$TMPDIR"