feat(security): verify drone-ssh binary checksum after download (#410)

* Verify drone-ssh binary checksum after download

Download checksums.txt from the drone-ssh release alongside the binary and verify it. Protects against tampered or corrupted release artifacts.

* refactor: make checksum verification portable across minimal containers

- Detect shasum (Perl) or sha256sum (coreutils/busybox) and fall back
  gracefully; warn and skip verification only when neither tool exists,
  so container jobs without perl are not broken
- Look up the exact checksums.txt entry for the target binary and
  compare hashes directly, avoiding the --ignore-missing flag that
  busybox sha256sum does not support
- Fail closed when checksums.txt has no entry for the binary
- Remove checksums.txt after successful verification

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

entrypoint.sh

@@ -62,6 +62,37 @@ else
     log_error "Downloaded file is missing or empty: ${TARGET}" "${ERR_INVALID_BINARY}"
   fi
 
+  # Verify checksum; container jobs may lack shasum (Perl) or sha256sum, so
+  # detect an available tool and skip verification with a warning if none exists
+  SHA256_CMD=""
+  if command -v shasum >/dev/null 2>&1; then
+    SHA256_CMD="shasum -a 256"
+  elif command -v sha256sum >/dev/null 2>&1; then
+    SHA256_CMD="sha256sum"
+  else
+    echo "Warning: neither shasum nor sha256sum is available, skipping checksum verification" >&2
+  fi
+
+  if [[ -n "${SHA256_CMD}" ]]; then
+    CHECKSUMS_FILE="${GITHUB_ACTION_PATH}/checksums.txt"
+    if ! curl -fsSL --retry 5 --keepalive-time 2 --location ${INSECURE_OPTION} \
+      "${DOWNLOAD_URL_PREFIX}/checksums.txt" -o "${CHECKSUMS_FILE}"; then
+      log_error "Failed to download checksums.txt from ${DOWNLOAD_URL_PREFIX}." "${ERR_DOWNLOAD_FAILED}"
+    fi
+
+    EXPECTED_CHECKSUM=$(awk -v bin="${CLIENT_BINARY}" '$2 == bin {print $1}' "${CHECKSUMS_FILE}")
+    if [[ -z "${EXPECTED_CHECKSUM}" ]]; then
+      log_error "No checksum entry found for ${CLIENT_BINARY} in checksums.txt." "${ERR_INVALID_BINARY}"
+    fi
+
+    ACTUAL_CHECKSUM=$(${SHA256_CMD} "${TARGET}" | awk '{print $1}')
+    if [[ "${ACTUAL_CHECKSUM}" != "${EXPECTED_CHECKSUM}" ]]; then
+      log_error "Checksum verification failed for ${CLIENT_BINARY}: expected ${EXPECTED_CHECKSUM}, got ${ACTUAL_CHECKSUM}." "${ERR_INVALID_BINARY}"
+    fi
+    echo "Checksum verification passed for ${CLIENT_BINARY}"
+    rm -f "${CHECKSUMS_FILE}"
+  fi
+
   chmod +x "${TARGET}"
 fi