enhancement: Examine release downloads with checksums #9

Blocker: no. Ship this in the same release as the monitoring agent.

Part of the monitoring agent (contract v0.2.1). Order: #26 → #27 → #28 → #29 → #30, with this issue after #29.

Defect

• The updater and install.sh install binaries without an integrity check.
• The updater operates as root.
• At this time, only TLS to GitHub protects the download during the transfer.
• With the monitoring agent, fly update also replaces the binary that the agent runs. The agent examines each download (enhancement: Run agent.update and agent.restart one time only #29), but fly update and install.sh do not.

Cost

• If a person changes a release asset, or if the asset becomes damaged, the servers install it without a warning.
• The damaged or changed binary then operates as root.

Benefit of the fix

• The updater and the installer reject a binary that does not agree with the published checksum.
• Signatures (cosign or minisign) can also show that the binary comes from FlyWP.

Fix

1. Wait until enhancement(ci): add checks for pull requests and replace the archived release actions #7 publishes checksums.txt. Done: ci: run make check on every change and publish releases with gh #25 publishes checksums.txt. The monitoring agent contract (v0.2.1) fixes the name and the format: one line for each tarball, <sha256> <file name>.
2. In fly update, download checksums.txt from the same release. Compare the sha256 of the tarball before the binary is extracted. If they do not agree, stop the update. Use the check code of enhancement: Run agent.update and agent.restart one time only #29.
3. In install.sh, examine the tarball with sha256sum -c against checksums.txt. If they do not agree, stop the installation.
4. Decide if the releases must also have signatures. This decision can wait.

Why now

• fly update operates as root and replaces the binary that the agent runs.
• This issue waited for enhancement(ci): add checks for pull requests and replace the archived release actions #7. enhancement(ci): add checks for pull requests and replace the archived release actions #7 is done.

Completion checks

• fly update stops, and keeps the old binary, when the tarball does not agree with checksums.txt.
• fly update stops with a clear error when the release has no checksums.txt.
• install.sh stops when the tarball does not agree with checksums.txt.