Verify supplied Base installer checksums before downstream pins

[codeforester]

Goal

Ensure downstream release automation publishes only installer checksums that match the exact Base release artifact being pinned.

Background

The downstream version-bump workflow accepts EVENT_INSTALLER_SHA256 when supplied and validates only that it is a 64-character lowercase hexadecimal string. When the value is omitted, the workflow computes a checksum from the release install.sh; when supplied, it never compares the value with downloaded release content. The downstream updater also validates only checksum shape.

A valid but incorrect supplied checksum can therefore be written into base-demo and cause its installer verification to fail. Current workflow and updater tests use synthetic checksum strings but do not cover matching and mismatching content.

Scope

• .github/workflows/downstream-version-bumps.yml installer checksum resolution
• cli/python/base_release/downstream_version_bump.py checksum contract as needed
• Workflow and updater tests for omitted, matching, mismatching, and malformed checksums

Acceptance Criteria

• The exact release install.sh bytes are hashed for every Base downstream bump.
• A supplied checksum must match the computed digest; a mismatch fails before a downstream issue or pin is created.
• The checksum written into downstream files is derived from or verified against the same release content and URL used by the workflow.
• Tests cover omitted, matching, mismatching, and malformed checksum inputs, including the no-issue-on-mismatch behavior.
• Failure output identifies the release and expected checksum without weakening installer verification.

Validation

• Workflow contract tests
• Focused downstream updater tests
• A shell fixture that exercises matching and mismatching checksum inputs
• git diff --check

Non-Goals

• No change to the Base installer verification mechanism.
• No acceptance of remote mutable branch content in place of the tagged release.

Project Fields

• Status: Backlog
• Priority: P2
• Area: Security
• Initiative: Contract Hardening
• Size: S
• Milestone: v1.10.0

Agent Assignment

• Human first; release artifact and downstream automation ownership need maintainer review before implementation.