Problem

prek downloads and executes toolchain binaries without verifying integrity. A corrupted CDN cache, truncated download, or tampered artifact installs silently.

Five of the six managed toolchain upstreams publish SHA256 checksums:

Proposed solution

Fetch the upstream checksum before download. Compute SHA256 while streaming to a temp file. Reject on mismatch before extraction. Fail closed: if the checksum is unavailable, malformed, or mismatched, abort the install.

This requires refactoring the download pipeline from streaming-into-extractor to download-then-verify-then-extract.

I have a draft PR covering Node, Bun, Go, and Rustup.

Notes

• Ruby (rv-ruby) does not publish checksums. A self-hash fallback (hash on first download, detect changes on subsequent installs) could cover this gap separately.
• Node and Bun also publish GPG signatures for their checksum files. Verifying those would close the same-origin trust gap for those two toolchains, but requires embedding public keys and a PGP verification dependency. Worth considering as a follow-up.