gleam and lefthook verify sha256 checksums of downloaded artifacts (via lib/verify.ab), but just, amber and oxlint install whatever the download returns.
- just: casey/just releases publish a
SHA256SUMS manifest, so verify_sha256_from_manifest should work as-is.
- amber / oxlint: check what checksum artifacts upstream publishes (per-file
.sha256, a manifest, or nothing) and use verify_sha256 / verify_sha256_from_manifest accordingly. If upstream publishes nothing, note that in the feature README instead.
The verification helpers already exist, so this is mostly wiring plus rebuilding the generated install.sh files.
gleam and lefthook verify sha256 checksums of downloaded artifacts (via
lib/verify.ab), but just, amber and oxlint install whatever the download returns.SHA256SUMSmanifest, soverify_sha256_from_manifestshould work as-is..sha256, a manifest, or nothing) and useverify_sha256/verify_sha256_from_manifestaccordingly. If upstream publishes nothing, note that in the feature README instead.The verification helpers already exist, so this is mostly wiring plus rebuilding the generated
install.shfiles.