From 68cfd97dba609621acf4ef83de01e0589c542720 Mon Sep 17 00:00:00 2001
From: dumko2001 <dumko.raj@gmail.com>
Date: Tue, 17 Mar 2026 15:10:06 +0530
Subject: [PATCH 1/4] fix(security): add checksum verification for external
 binary downloads

---
 scripts/brev-setup.sh | 32 ++++++++++++++++++++++++--------
 scripts/install.sh    | 37 +++++++++++++++++++++++++++++--------
 2 files changed, 53 insertions(+), 16 deletions(-)

diff --git a/scripts/brev-setup.sh b/scripts/brev-setup.sh
index cc8701ba9ac..99d0b6b80f1 100755
--- a/scripts/brev-setup.sh
+++ b/scripts/brev-setup.sh
@@ -77,21 +77,29 @@ if command -v nvidia-smi >/dev/null 2>&1; then
 fi
 
 # --- 3. openshell CLI (binary release, not pip) ---
+OPENSHELL_VERSION="v0.0.8"
 if ! command -v openshell >/dev/null 2>&1; then
-  info "Installing openshell CLI from GitHub release..."
+  info "Installing openshell CLI (${OPENSHELL_VERSION})..."
   if ! command -v gh >/dev/null 2>&1; then
     sudo apt-get update -qq >/dev/null 2>&1
     sudo apt-get install -y -qq gh >/dev/null 2>&1
   fi
   ARCH="$(uname -m)"
   case "$ARCH" in
-    x86_64 | amd64) ASSET="openshell-x86_64-unknown-linux-musl.tar.gz" ;;
-    aarch64 | arm64) ASSET="openshell-aarch64-unknown-linux-musl.tar.gz" ;;
+    x86_64 | amd64)
+      ASSET="openshell-x86_64-unknown-linux-musl.tar.gz"
+      EXPECTED_SHA="203a4732b8a8974c4f612132ea0325f2a1b298dff0fe639dc8f9aff4f26f8cc3"
+      ;;
+    aarch64 | arm64)
+      ASSET="openshell-aarch64-unknown-linux-musl.tar.gz"
+      EXPECTED_SHA="e5efa57bf80bbc8fce4d47cc7f7fc7ccaaa65d57e9cca8094e1cd72c0a7ff72e"
+      ;;
     *) fail "Unsupported architecture: $ARCH" ;;
   esac
   tmpdir="$(mktemp -d)"
-  GH_TOKEN="${GITHUB_TOKEN:-}" gh release download --repo NVIDIA/OpenShell \
+  GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "$OPENSHELL_VERSION" --repo NVIDIA/OpenShell \
     --pattern "$ASSET" --dir "$tmpdir"
+  echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | sha256sum -c -
   tar xzf "$tmpdir/$ASSET" -C "$tmpdir"
   sudo install -m 755 "$tmpdir/openshell" /usr/local/bin/openshell
   rm -rf "$tmpdir"
@@ -101,16 +109,24 @@ else
 fi
 
 # --- 3b. cloudflared (for public tunnel) ---
+CLOUDFLARED_VERSION="2025.2.0"
 if ! command -v cloudflared >/dev/null 2>&1; then
-  info "Installing cloudflared..."
+  info "Installing cloudflared (${CLOUDFLARED_VERSION})..."
   CF_ARCH="$(uname -m)"
   case "$CF_ARCH" in
-    x86_64 | amd64) CF_ARCH="amd64" ;;
-    aarch64 | arm64) CF_ARCH="arm64" ;;
+    x86_64 | amd64)
+      CF_BIN_ARCH="amd64"
+      EXPECTED_SHA="cbd18c5a6dee084db7a55d761b91202e47e63ddbd18d0faff04ca96e56739b3f"
+      ;;
+    aarch64 | arm64)
+      CF_BIN_ARCH="arm64"
+      EXPECTED_SHA="92b8917aeb655ef8b9e90176dd9475b40ea85ec54b21bcafbdf57d9a68b72d15"
+      ;;
     *) fail "Unsupported architecture for cloudflared: $CF_ARCH" ;;
   esac
   tmpdir=$(mktemp -d)
-  curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${CF_ARCH}" -o "$tmpdir/cloudflared"
+  curl -fsSL "https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-${CF_BIN_ARCH}" -o "$tmpdir/cloudflared"
+  echo "${EXPECTED_SHA}  $tmpdir/cloudflared" | sha256sum -c -
   sudo install -m 755 "$tmpdir/cloudflared" /usr/local/bin/cloudflared
   rm -rf "$tmpdir"
   info "cloudflared $(cloudflared --version 2>&1 | head -1) installed"
diff --git a/scripts/install.sh b/scripts/install.sh
index b00de5e86d5..22921816906 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -323,33 +323,54 @@ install_openshell() {
     return 0
   fi
 
-  info "Installing openshell CLI..."
+  OPENSHELL_VERSION="v0.0.8"
+  info "Installing openshell CLI (${OPENSHELL_VERSION})..."
 
   case "$OS" in
     Darwin)
       case "$ARCH_LABEL" in
-        x86_64) ASSET="openshell-x86_64-apple-darwin.tar.gz" ;;
-        aarch64) ASSET="openshell-aarch64-apple-darwin.tar.gz" ;;
+        aarch64)
+          ASSET="openshell-aarch64-apple-darwin.tar.gz"
+          EXPECTED_SHA="8b0945ad046b48b9f1b82d14f45c68c7a9ab6138af27778a644193a9973e0048"
+          ;;
+        *)
+          fail "OpenShell ${OPENSHELL_VERSION} does not support Intel-based Macs (x86_64). Please use an Apple Silicon Mac or build OpenShell from source."
+          ;;
       esac
       ;;
     Linux)
       case "$ARCH_LABEL" in
-        x86_64) ASSET="openshell-x86_64-unknown-linux-musl.tar.gz" ;;
-        aarch64) ASSET="openshell-aarch64-unknown-linux-musl.tar.gz" ;;
+        x86_64)
+          ASSET="openshell-x86_64-unknown-linux-musl.tar.gz"
+          EXPECTED_SHA="203a4732b8a8974c4f612132ea0325f2a1b298dff0fe639dc8f9aff4f26f8cc3"
+          ;;
+        aarch64)
+          ASSET="openshell-aarch64-unknown-linux-musl.tar.gz"
+          EXPECTED_SHA="e5efa57bf80bbc8fce4d47cc7f7fc7ccaaa65d57e9cca8094e1cd72c0a7ff72e"
+          ;;
       esac
       ;;
   esac
 
   tmpdir="$(mktemp -d)"
   if command -v gh >/dev/null 2>&1; then
-    GH_TOKEN="${GITHUB_TOKEN:-}" gh release download --repo NVIDIA/OpenShell \
+    GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "${OPENSHELL_VERSION}" --repo NVIDIA/OpenShell \
       --pattern "$ASSET" --dir "$tmpdir"
   else
-    # Fallback: curl latest release
-    curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/latest/download/$ASSET" \
+    # Fallback: curl pinned release
+    curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/download/${OPENSHELL_VERSION}/$ASSET" \
       -o "$tmpdir/$ASSET"
   fi
 
+  # Verify checksum
+  if command -v sha256sum >/dev/null 2>&1; then
+    echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | sha256sum -c -
+  elif command -v shasum >/dev/null 2>&1; then
+    echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | shasum -a 256 -c -
+  else
+    warn "sha256sum not found, skipping checksum verification"
+  fi
+
   tar xzf "$tmpdir/$ASSET" -C "$tmpdir"
 
   if [ -w /usr/local/bin ]; then

From 50b9f0bd721ba9f64bc35e8cf2fe6302cef0e5dc Mon Sep 17 00:00:00 2001
From: dumko2001 <dumko.raj@gmail.com>
Date: Sun, 22 Mar 2026 17:35:49 +0530
Subject: [PATCH 2/4] fix: enforce checksum verification and handle unsupported
 architectures

---
 scripts/brev-setup.sh | 22 ++++++++++++++++++++--
 scripts/install.sh    |  2 +-
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/scripts/brev-setup.sh b/scripts/brev-setup.sh
index 99d0b6b80f1..1842c8f9e2a 100755
--- a/scripts/brev-setup.sh
+++ b/scripts/brev-setup.sh
@@ -99,7 +99,16 @@ if ! command -v openshell >/dev/null 2>&1; then
   tmpdir="$(mktemp -d)"
   GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "$OPENSHELL_VERSION" --repo NVIDIA/OpenShell \
     --pattern "$ASSET" --dir "$tmpdir"
-  echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | sha256sum -c -
+
+  # Verify checksum
+  if command -v sha256sum > /dev/null 2>&1; then
+    echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | sha256sum -c -
+  elif command -v shasum > /dev/null 2>&1; then
+    echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | shasum -a 256 -c -
+  else
+    fail "sha256sum or shasum not found. Cannot verify binary integrity."
+  fi
+
   tar xzf "$tmpdir/$ASSET" -C "$tmpdir"
   sudo install -m 755 "$tmpdir/openshell" /usr/local/bin/openshell
   rm -rf "$tmpdir"
@@ -126,7 +135,16 @@ if ! command -v cloudflared >/dev/null 2>&1; then
   esac
   tmpdir=$(mktemp -d)
   curl -fsSL "https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-${CF_BIN_ARCH}" -o "$tmpdir/cloudflared"
-  echo "${EXPECTED_SHA}  $tmpdir/cloudflared" | sha256sum -c -
+
+  # Verify checksum
+  if command -v sha256sum >/dev/null 2>&1; then
+    echo "${EXPECTED_SHA}  $tmpdir/cloudflared" | sha256sum -c -
+  elif command -v shasum >/dev/null 2>&1; then
+    echo "${EXPECTED_SHA}  $tmpdir/cloudflared" | shasum -a 256 -c -
+  else
+    fail "sha256sum or shasum not found. Cannot verify binary integrity."
+  fi
+
   sudo install -m 755 "$tmpdir/cloudflared" /usr/local/bin/cloudflared
   rm -rf "$tmpdir"
   info "cloudflared $(cloudflared --version 2>&1 | head -1) installed"
diff --git a/scripts/install.sh b/scripts/install.sh
index 22921816906..931e0725bf4 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -368,7 +368,7 @@ install_openshell() {
   elif command -v shasum >/dev/null 2>&1; then
     echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | shasum -a 256 -c -
   else
-    warn "sha256sum not found, skipping checksum verification"
+    fail "sha256sum or shasum not found. Cannot verify binary integrity."
   fi
 
   tar xzf "$tmpdir/$ASSET" -C "$tmpdir"

From 5b04d6d9b5c4eecf8545a0b70cfcf0ed0382dab3 Mon Sep 17 00:00:00 2001
From: dumko2001 <dumko.raj@gmail.com>
Date: Tue, 24 Mar 2026 12:18:27 +0530
Subject: [PATCH 3/4] fix: enforce checksum verification and handle unsupported
 architectures

---
 scripts/brev-setup.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/brev-setup.sh b/scripts/brev-setup.sh
index 1842c8f9e2a..265611b8adc 100755
--- a/scripts/brev-setup.sh
+++ b/scripts/brev-setup.sh
@@ -101,9 +101,9 @@ if ! command -v openshell >/dev/null 2>&1; then
     --pattern "$ASSET" --dir "$tmpdir"
 
   # Verify checksum
-  if command -v sha256sum > /dev/null 2>&1; then
+  if command -v sha256sum >/dev/null 2>&1; then
     echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | sha256sum -c -
-  elif command -v shasum > /dev/null 2>&1; then
+  elif command -v shasum >/dev/null 2>&1; then
     echo "${EXPECTED_SHA}  $tmpdir/$ASSET" | shasum -a 256 -c -
   else
     fail "sha256sum or shasum not found. Cannot verify binary integrity."

From 5e78aa1bbebc1420d304ad75716d107444c38438 Mon Sep 17 00:00:00 2001
From: dumko2001 <dumko.raj@gmail.com>
Date: Tue, 24 Mar 2026 12:27:21 +0530
Subject: [PATCH 4/4] fix(security): update OpenShell to v0.0.14 and add gh
 fallback

---
 scripts/brev-setup.sh | 22 +++++++++++++++++-----
 scripts/install.sh    | 20 +++++++++++++-------
 2 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/scripts/brev-setup.sh b/scripts/brev-setup.sh
index 265611b8adc..6f49af19f80 100755
--- a/scripts/brev-setup.sh
+++ b/scripts/brev-setup.sh
@@ -77,7 +77,7 @@ if command -v nvidia-smi >/dev/null 2>&1; then
 fi
 
 # --- 3. openshell CLI (binary release, not pip) ---
-OPENSHELL_VERSION="v0.0.8"
+OPENSHELL_VERSION="v0.0.14"
 if ! command -v openshell >/dev/null 2>&1; then
   info "Installing openshell CLI (${OPENSHELL_VERSION})..."
   if ! command -v gh >/dev/null 2>&1; then
@@ -88,17 +88,29 @@ if ! command -v openshell >/dev/null 2>&1; then
   case "$ARCH" in
     x86_64 | amd64)
       ASSET="openshell-x86_64-unknown-linux-musl.tar.gz"
-      EXPECTED_SHA="203a4732b8a8974c4f612132ea0325f2a1b298dff0fe639dc8f9aff4f26f8cc3"
+      EXPECTED_SHA="f34acf072452180adc872db207eec16f2aa77b6e2723c7456677c281d7d1d9d6"
       ;;
     aarch64 | arm64)
       ASSET="openshell-aarch64-unknown-linux-musl.tar.gz"
-      EXPECTED_SHA="e5efa57bf80bbc8fce4d47cc7f7fc7ccaaa65d57e9cca8094e1cd72c0a7ff72e"
+      EXPECTED_SHA="6c70bd3112ba6524c16718b0ba37474238011d74c694b2f18aa6003da13128a5"
       ;;
     *) fail "Unsupported architecture: $ARCH" ;;
   esac
   tmpdir="$(mktemp -d)"
-  GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "$OPENSHELL_VERSION" --repo NVIDIA/OpenShell \
-    --pattern "$ASSET" --dir "$tmpdir"
+  DOWNLOAD_SUCCESS=0
+
+  if command -v gh >/dev/null 2>&1; then
+    if GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "$OPENSHELL_VERSION" --repo NVIDIA/OpenShell \
+      --pattern "$ASSET" --dir "$tmpdir"; then
+      DOWNLOAD_SUCCESS=1
+    fi
+  fi
+
+  if [ "$DOWNLOAD_SUCCESS" -eq 0 ]; then
+    # Fallback: curl pinned release
+    curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/download/${OPENSHELL_VERSION}/$ASSET" \
+      -o "$tmpdir/$ASSET"
+  fi
 
   # Verify checksum
   if command -v sha256sum >/dev/null 2>&1; then
diff --git a/scripts/install.sh b/scripts/install.sh
index 931e0725bf4..90311126cad 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -323,7 +323,7 @@ install_openshell() {
     return 0
   fi
 
-  OPENSHELL_VERSION="v0.0.8"
+  OPENSHELL_VERSION="v0.0.14"
   info "Installing openshell CLI (${OPENSHELL_VERSION})..."
 
   case "$OS" in
@@ -331,7 +331,7 @@ install_openshell() {
       case "$ARCH_LABEL" in
         aarch64)
           ASSET="openshell-aarch64-apple-darwin.tar.gz"
-          EXPECTED_SHA="8b0945ad046b48b9f1b82d14f45c68c7a9ab6138af27778a644193a9973e0048"
+          EXPECTED_SHA="f05699b74a9c60f105b7af9224f268f126256196d066de91b423bfa5be066eca"
           ;;
         *)
           fail "OpenShell ${OPENSHELL_VERSION} does not support Intel-based Macs (x86_64). Please use an Apple Silicon Mac or build OpenShell from source."
@@ -342,21 +342,27 @@ install_openshell() {
       case "$ARCH_LABEL" in
         x86_64)
           ASSET="openshell-x86_64-unknown-linux-musl.tar.gz"
-          EXPECTED_SHA="203a4732b8a8974c4f612132ea0325f2a1b298dff0fe639dc8f9aff4f26f8cc3"
+          EXPECTED_SHA="f34acf072452180adc872db207eec16f2aa77b6e2723c7456677c281d7d1d9d6"
           ;;
         aarch64)
           ASSET="openshell-aarch64-unknown-linux-musl.tar.gz"
-          EXPECTED_SHA="e5efa57bf80bbc8fce4d47cc7f7fc7ccaaa65d57e9cca8094e1cd72c0a7ff72e"
+          EXPECTED_SHA="6c70bd3112ba6524c16718b0ba37474238011d74c694b2f18aa6003da13128a5"
           ;;
       esac
       ;;
   esac
 
   tmpdir="$(mktemp -d)"
+  local DOWNLOAD_SUCCESS=0
+
   if command -v gh >/dev/null 2>&1; then
-    GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "${OPENSHELL_VERSION}" --repo NVIDIA/OpenShell \
-      --pattern "$ASSET" --dir "$tmpdir"
-  else
+    if GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "${OPENSHELL_VERSION}" --repo NVIDIA/OpenShell \
+      --pattern "$ASSET" --dir "$tmpdir"; then
+      DOWNLOAD_SUCCESS=1
+    fi
+  fi
+
+  if [ "$DOWNLOAD_SUCCESS" -eq 0 ]; then
     # Fallback: curl pinned release
     curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/download/${OPENSHELL_VERSION}/$ASSET" \
       -o "$tmpdir/$ASSET"