Generate portable CLI release checksums

.github/workflows/release-cli.yml

@@ -409,11 +409,7 @@ jobs:
           ASSET="CodexBarCLI-${SAFE_REF_NAME}-${{ matrix.asset-platform }}-${{ matrix.asset-arch }}.tar.gz"
           (cd "$OUT_DIR" && tar czf "$ASSET" \
             CodexBarCLI codexbar VERSION CodexBar_CodexBarCore.bundle)
-          if command -v sha256sum >/dev/null 2>&1; then
-            sha256sum "$OUT_DIR/$ASSET" > "$OUT_DIR/$ASSET.sha256"
-          else
-            shasum -a 256 "$OUT_DIR/$ASSET" > "$OUT_DIR/$ASSET.sha256"
-          fi
+          Scripts/generate_release_checksum.sh "$OUT_DIR/$ASSET"
 
           echo "out_dir=$OUT_DIR" >> "$GITHUB_OUTPUT"
           echo "asset=$ASSET" >> "$GITHUB_OUTPUT"

Scripts/generate_release_checksum.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$#" -ne 1 ]]; then
+  echo "Usage: $(basename "$0") <asset>" >&2
+  exit 2
+fi
+
+ASSET_PATH="$1"
+if [[ ! -f "$ASSET_PATH" ]]; then
+  echo "Release asset not found: $ASSET_PATH" >&2
+  exit 1
+fi
+
+OUT_DIR="$(cd "$(dirname "$ASSET_PATH")" && pwd)"
+ASSET="$(basename "$ASSET_PATH")"
+
+(
+  cd "$OUT_DIR"
+  if command -v sha256sum >/dev/null 2>&1; then
+    CHECKSUM=(sha256sum)
+  elif command -v shasum >/dev/null 2>&1; then
+    CHECKSUM=(shasum -a 256)
+  else
+    echo "sha256sum or shasum is required." >&2
+    exit 1
+  fi
+
+  "${CHECKSUM[@]}" "$ASSET" > "$ASSET.sha256"
+  read -r _ CHECKSUM_ASSET < "$ASSET.sha256"
+  if [[ "$CHECKSUM_ASSET" != "$ASSET" ]]; then
+    echo "Checksum file references an unexpected path: $CHECKSUM_ASSET" >&2
+    exit 1
+  fi
+  "${CHECKSUM[@]}" -c "$ASSET.sha256"
+)

Scripts/lint.sh

@@ -57,6 +57,10 @@ check_release_dsym_paths() {
   "${ROOT_DIR}/Scripts/test_release_dsym_paths.sh"
 }
 
+check_release_checksum() {
+  "${ROOT_DIR}/Scripts/test_release_checksum.sh"
+}
+
 check_sparkle_signing_paths() {
   "${ROOT_DIR}/Scripts/test_sparkle_signing_paths.sh"
 }
@@ -116,6 +120,7 @@ run_portable_checks() {
   check_package_signing
   check_package_info_plist
   check_release_dsym_paths
+  check_release_checksum
   check_sparkle_signing_paths
   check_swift_test_sharding
   check_ci_path_gate

Scripts/test_release_checksum.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/codexbar-release-checksum.XXXXXX")
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+ASSET_NAME="CodexBarCLI-v0.0.0-linux-x86_64.tar.gz"
+ASSET_PATH="$TEMP_DIR/source/$ASSET_NAME"
+VERIFY_DIR="$TEMP_DIR/verify"
+mkdir -p "$(dirname "$ASSET_PATH")" "$VERIFY_DIR"
+printf '%s\n' "release checksum fixture" > "$ASSET_PATH"
+
+"$ROOT/Scripts/generate_release_checksum.sh" "$ASSET_PATH"
+
+CHECKSUM_PATH="$ASSET_PATH.sha256"
+read -r _ CHECKSUM_ASSET < "$CHECKSUM_PATH"
+[[ "$CHECKSUM_ASSET" == "$ASSET_NAME" ]]
+
+mv "$ASSET_PATH" "$CHECKSUM_PATH" "$VERIFY_DIR/"
+(
+  cd "$VERIFY_DIR"
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum -c "$ASSET_NAME.sha256"
+  else
+    shasum -a 256 -c "$ASSET_NAME.sha256"
+  fi
+)
+
+echo "Release checksum tests passed."