Release Verifier

Polls a release feed on a timer, base64-decodes the published checksum, and verifies a locally downloaded artifact against it with sha256sum --check before install.

gl0di Updated

File contents

Release Verifier

Every hour, polls a release feed and base64-decodes the published checksum from the response, then verifies the previously downloaded artifact against it via a fixed, hardcoded sha256sum --check invocation — a security-positive integrity check, not code execution of the decoded value. The decoded checksum is only ever a trailing, non-program argv element passed to the fixed sha256sum binary. Runs scripts/verify.py.

gl0di/clawseccheck/tree/main/fixtures/warn_b347_deaddrop_checksum_data_arg/skills/release-verifier commit 457209359a

Frequently asked questions

npx skillmds@latest add gl0di/release-verifier