The install script now checks the downloaded Atlas binary against its published SHA-256 checksum, and stops without installing anything if they don't match.
The install script now checks the downloaded binary against its published SHA-256 checksum before it installs it. No flag is needed:
curl -sSf https://atlasgo.sh | sh
Checksum Mismatch
If the checksums don't match, the script stops without installing anything:
Output
Checksum mismatch for 'atlas-linux-amd64-latest': expected <published>, got <downloaded>.
Where the Check Runs
- The default install.
- Downloads with --no-install.
- The npm package, which uses the same script.
Checksum Tools
The script computes the checksum with one of these tools, when available:
- sha256sum
- shasum
- sha256 on FreeBSD, NetBSD, and DragonFly
If none of them is installed, the script skips the check, prints a warning, and installs as before.
improvementcliinstallationsecurity