From ae3eb91f76d982d18d0327bceab60efd75a1ca75 Mon Sep 17 00:00:00 2001
From: Devraj Mehta <devm33@github.com>
Date: Tue, 16 Dec 2025 09:50:54 -0500
Subject: [PATCH 1/3] Add checksum validation to install script

---
 install.sh | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/install.sh b/install.sh
index c6632e0a..ef37c0e0 100755
--- a/install.sh
+++ b/install.sh
@@ -42,8 +42,10 @@ if [ -n "$VERSION" ]; then
     *) VERSION="v$VERSION" ;;
   esac
   DOWNLOAD_URL="https://github.com/github/copilot-cli/releases/download/${VERSION}/copilot-${PLATFORM}-${ARCH}.tar.gz"
+  CHECKSUMS_URL="https://github.com/github/copilot-cli/releases/download/${VERSION}/SHA256SUMS.txt"
 else
   DOWNLOAD_URL="https://github.com/github/copilot-cli/releases/latest/download/copilot-${PLATFORM}-${ARCH}.tar.gz"
+  CHECKSUMS_URL="https://github.com/github/copilot-cli/releases/latest/download/SHA256SUMS.txt"
 fi
 echo "Downloading from: $DOWNLOAD_URL"
 
@@ -58,6 +60,41 @@ else
   exit 1
 fi
 
+# Attempt to download checksums file and validate
+TMP_CHECKSUMS="$(mktemp)"
+CHECKSUMS_AVAILABLE=false
+if command -v curl >/dev/null 2>&1; then
+  curl -fsSL "$CHECKSUMS_URL" -o "$TMP_CHECKSUMS" 2>/dev/null && CHECKSUMS_AVAILABLE=true
+elif command -v wget >/dev/null 2>&1; then
+  wget -qO "$TMP_CHECKSUMS" "$CHECKSUMS_URL" 2>/dev/null && CHECKSUMS_AVAILABLE=true
+fi
+
+if [ "$CHECKSUMS_AVAILABLE" = true ]; then
+  TARBALL_NAME="copilot-${PLATFORM}-${ARCH}.tar.gz"
+  EXPECTED_CHECKSUM=$(grep "$TARBALL_NAME" "$TMP_CHECKSUMS" | awk '{print $1}')
+  if [ -n "$EXPECTED_CHECKSUM" ]; then
+    if command -v sha256sum >/dev/null 2>&1; then
+      ACTUAL_CHECKSUM=$(sha256sum "$TMP_TARBALL" | awk '{print $1}')
+    elif command -v shasum >/dev/null 2>&1; then
+      ACTUAL_CHECKSUM=$(shasum -a 256 "$TMP_TARBALL" | awk '{print $1}')
+    else
+      echo "Warning: No sha256sum or shasum found, skipping checksum validation."
+      ACTUAL_CHECKSUM=""
+    fi
+    if [ -n "$ACTUAL_CHECKSUM" ]; then
+      if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+        echo "Error: Checksum validation failed." >&2
+        echo "Expected: $EXPECTED_CHECKSUM" >&2
+        echo "Actual:   $ACTUAL_CHECKSUM" >&2
+        rm -f "$TMP_TARBALL" "$TMP_CHECKSUMS"
+        exit 1
+      fi
+      echo "✓ Checksum validated"
+    fi
+  fi
+fi
+rm -f "$TMP_CHECKSUMS"
+
 # Check that the file is a valid tarball
 if ! tar -tzf "$TMP_TARBALL" >/dev/null 2>&1; then
   echo "Error: Downloaded file is not a valid tarball or is corrupted." >&2

From 1d69e658630dee924d467a43d29be59f0c0110f6 Mon Sep 17 00:00:00 2001
From: Devraj Mehta <devm33@github.com>
Date: Tue, 16 Dec 2025 15:59:42 +0000
Subject: [PATCH 2/3] Use checksum file directly instead of grepping

---
 install.sh | 31 ++++++++++++++-----------------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/install.sh b/install.sh
index ef37c0e0..507f87d7 100755
--- a/install.sh
+++ b/install.sh
@@ -70,27 +70,24 @@ elif command -v wget >/dev/null 2>&1; then
 fi
 
 if [ "$CHECKSUMS_AVAILABLE" = true ]; then
-  TARBALL_NAME="copilot-${PLATFORM}-${ARCH}.tar.gz"
-  EXPECTED_CHECKSUM=$(grep "$TARBALL_NAME" "$TMP_CHECKSUMS" | awk '{print $1}')
-  if [ -n "$EXPECTED_CHECKSUM" ]; then
-    if command -v sha256sum >/dev/null 2>&1; then
-      ACTUAL_CHECKSUM=$(sha256sum "$TMP_TARBALL" | awk '{print $1}')
-    elif command -v shasum >/dev/null 2>&1; then
-      ACTUAL_CHECKSUM=$(shasum -a 256 "$TMP_TARBALL" | awk '{print $1}')
+  if command -v sha256sum >/dev/null 2>&1; then
+    if (cd "$(dirname "$TMP_TARBALL")" && sha256sum -c --ignore-missing "$TMP_CHECKSUMS" 2>/dev/null | grep -q "$(basename "$TMP_TARBALL")"); then
+      echo "✓ Checksum validated"
     else
-      echo "Warning: No sha256sum or shasum found, skipping checksum validation."
-      ACTUAL_CHECKSUM=""
+      echo "Error: Checksum validation failed." >&2
+      rm -f "$TMP_TARBALL" "$TMP_CHECKSUMS"
+      exit 1
     fi
-    if [ -n "$ACTUAL_CHECKSUM" ]; then
-      if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
-        echo "Error: Checksum validation failed." >&2
-        echo "Expected: $EXPECTED_CHECKSUM" >&2
-        echo "Actual:   $ACTUAL_CHECKSUM" >&2
-        rm -f "$TMP_TARBALL" "$TMP_CHECKSUMS"
-        exit 1
-      fi
+  elif command -v shasum >/dev/null 2>&1; then
+    if (cd "$(dirname "$TMP_TARBALL")" && shasum -a 256 -c --ignore-missing "$TMP_CHECKSUMS" 2>/dev/null | grep -q "$(basename "$TMP_TARBALL")"); then
       echo "✓ Checksum validated"
+    else
+      echo "Error: Checksum validation failed." >&2
+      rm -f "$TMP_TARBALL" "$TMP_CHECKSUMS"
+      exit 1
     fi
+  else
+    echo "Warning: No sha256sum or shasum found, skipping checksum validation."
   fi
 fi
 rm -f "$TMP_CHECKSUMS"

From b80851857711cf99680e5a5dfb19153bf71082d3 Mon Sep 17 00:00:00 2001
From: Devraj Mehta <devm33@github.com>
Date: Tue, 16 Dec 2025 16:15:57 +0000
Subject: [PATCH 3/3] Refactor installation script to use temporary directory
 for downloads and checksum validation

---
 install.sh | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/install.sh b/install.sh
index 507f87d7..01886f13 100755
--- a/install.sh
+++ b/install.sh
@@ -50,18 +50,20 @@ fi
 echo "Downloading from: $DOWNLOAD_URL"
 
 # Download and extract with error handling
-TMP_TARBALL="$(mktemp)"
+TMP_DIR="$(mktemp -d)"
+TMP_TARBALL="$TMP_DIR/copilot-${PLATFORM}-${ARCH}.tar.gz"
 if command -v curl >/dev/null 2>&1; then
   curl -fsSL "$DOWNLOAD_URL" -o "$TMP_TARBALL"
 elif command -v wget >/dev/null 2>&1; then
   wget -qO "$TMP_TARBALL" "$DOWNLOAD_URL"
 else
   echo "Error: Neither curl nor wget found. Please install one of them."
+  rm -rf "$TMP_DIR"
   exit 1
 fi
 
 # Attempt to download checksums file and validate
-TMP_CHECKSUMS="$(mktemp)"
+TMP_CHECKSUMS="$TMP_DIR/SHA256SUMS.txt"
 CHECKSUMS_AVAILABLE=false
 if command -v curl >/dev/null 2>&1; then
   curl -fsSL "$CHECKSUMS_URL" -o "$TMP_CHECKSUMS" 2>/dev/null && CHECKSUMS_AVAILABLE=true
@@ -71,31 +73,30 @@ fi
 
 if [ "$CHECKSUMS_AVAILABLE" = true ]; then
   if command -v sha256sum >/dev/null 2>&1; then
-    if (cd "$(dirname "$TMP_TARBALL")" && sha256sum -c --ignore-missing "$TMP_CHECKSUMS" 2>/dev/null | grep -q "$(basename "$TMP_TARBALL")"); then
+    if (cd "$TMP_DIR" && sha256sum -c --ignore-missing SHA256SUMS.txt >/dev/null 2>&1); then
       echo "✓ Checksum validated"
     else
       echo "Error: Checksum validation failed." >&2
-      rm -f "$TMP_TARBALL" "$TMP_CHECKSUMS"
+      rm -rf "$TMP_DIR"
       exit 1
     fi
   elif command -v shasum >/dev/null 2>&1; then
-    if (cd "$(dirname "$TMP_TARBALL")" && shasum -a 256 -c --ignore-missing "$TMP_CHECKSUMS" 2>/dev/null | grep -q "$(basename "$TMP_TARBALL")"); then
+    if (cd "$TMP_DIR" && shasum -a 256 -c --ignore-missing SHA256SUMS.txt >/dev/null 2>&1); then
       echo "✓ Checksum validated"
     else
       echo "Error: Checksum validation failed." >&2
-      rm -f "$TMP_TARBALL" "$TMP_CHECKSUMS"
+      rm -rf "$TMP_DIR"
       exit 1
     fi
   else
     echo "Warning: No sha256sum or shasum found, skipping checksum validation."
   fi
 fi
-rm -f "$TMP_CHECKSUMS"
 
 # Check that the file is a valid tarball
 if ! tar -tzf "$TMP_TARBALL" >/dev/null 2>&1; then
   echo "Error: Downloaded file is not a valid tarball or is corrupted." >&2
-  rm -f "$TMP_TARBALL"
+  rm -rf "$TMP_DIR"
   exit 1
 fi
 
@@ -119,7 +120,7 @@ fi
 tar -xz -C "$INSTALL_DIR" -f "$TMP_TARBALL"
 chmod +x "$INSTALL_DIR/copilot"
 echo "✓ GitHub Copilot CLI installed to $INSTALL_DIR/copilot"
-rm -f "$TMP_TARBALL"
+rm -rf "$TMP_DIR"
 
 # Check if install directory is in PATH
 case ":$PATH:" in