fix(setup): checksum-verified just install instead of curl|bash (CWE-494) - #117

Merged

hyperpolymath merged 5 commits into

mainfrom

fix/verified-just-install-signed

Oct 1, 2026

Commits on Sep 30, 2026

fix(setup): install just from a checksum-verified release, not curl|bash

hyperpolymath
and
claude
committed
833e33f
docs(setup): stop advertising curl|sh in the usage comment

hyperpolymath
and
claude
committed
32c3d71
Update build/setup.sh

hyperpolymath
and
coderabbitai[bot]
authored
7815dc7
fix(ci): skip instant-sync dispatch cleanly when FARM_DISPATCH_TOKEN is absent

hyperpolymath
and
claude
committed
0e25fc8
docs(setup): document just installation helpers and failure behavior

coderabbitai[bot]
authored and
hyperpolymath
committed
64c0a7d