scripts/install.sh pipes a network-fetched installer to sh without integrity verification

[potiuk]

Hi! I'm reviewing untitaker/hyperlink for the Apache Software Foundation's GitHub Actions allowlist (downstream: apache/infrastructure-actions#916, bumping 0.2.0 → 0.2.1).

scripts/install.sh fetches the installer over the network and pipes it straight to a shell with no integrity check:

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/untitaker/hyperlink/releases/download/$tag/hyperlink-installer.sh | sh

A compromised or MITM'd release asset would run arbitrary code on the runner. The good news: your releases already publish checksums — each artifact has a .sha256, plus an aggregate sha256.sum. Two ways to close the gap:

1. Download the platform binary directly and verify it against the published .sha256 before use, instead of curl … | sh; or
2. pin + checksum-verify hyperlink-installer.sh itself.

Happy to send a PR. Thanks for already shipping the checksums — it makes this a small change.

[untitaker]

@potiuk this is the third duplicate issue you have opened. can you cut it out? i've already replied to the first one saying that I would welcome a contribution. if this continues i will ban you from the repo. it doesn't help that you are clearly using AI to open them.

ref #198
ref #199

[potiuk]

I am truly sorry for that. I should have been more careful.