fix(install): verify release checksums fail closed by avivsinai · Pull Request #291 · avivsinai/agent-message-queue

avivsinai · 2026-07-25T07:29:44Z

Summary

require SHA-256 verification before extracting release archives
stage validated binaries beside the target and atomically replace only after all checks pass
preserve an existing install on download, checksum, extraction, or validation failure
make the documented manual install flow fail closed in ordinary interactive shells

Merge is held for exact-head ChatGPT Pro review.

🤖 I have created a release *beep* *boop* --- ## [0.47.3](v0.47.2...v0.47.3) (2026-07-26) ### Bug Fixes * **cli:** reject stray leaf arguments ([#293](#293)) ([9bd6c1a](9bd6c1a)) * **install:** verify release checksums fail closed ([#291](#291)) ([321881c](321881c)) * **wake:** admit wake when an unverified generic lock cannot be proven ([#301](#301)) ([d177948](d177948)) * **wake:** close wake terminal descriptors on exec ([#300](#300)) ([e4db6ea](e4db6ea)) * **wake:** make interrupt injection opt-in ([#299](#299)) ([bf11814](bf11814)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

avivsinai added 2 commits July 25, 2026 10:29

fix(install): verify release checksums fail closed

990686c

fix(installer): fail closed before publishing binary

50a3f93

avivsinai merged commit 321881c into main Jul 26, 2026
5 checks passed

avivsinai deleted the fix/install-checksum-fail-closed branch July 26, 2026 12:26

avivsinai mentioned this pull request Jul 26, 2026

chore(release): v0.47.3 #298

Merged