#1941 install.sh: 'stable' alias tarball and .sha256 are published non-atomically — checksum verification fails during every release window

Summary

install.sh verifies the downloaded tarball against <alias>/…/<asset>.sha256 (the stable alias object), but the alias tarball and the alias .sha256 are updated as two separate writes on every release. A client that runs inside that window gets one release's tarball and the other release's checksum and dies with:

xxx SHA-256 checksum verification failed for 'swamp-stable-binary-linux-x86_64.tar.gz'

Observed

• 2026-09-01 21🔞45Z, GitHub Actions ubuntu-24.04, curl -fsSL https://swamp.club/install.sh | sh -s -- -d "$dest" -V stable
• The tarball download logged Following S3 redirect to …/swamp/20260901.204821.0-sha.e6558412/… (release cut 20:48Z); the .sha256 fetched immediately after did not match it.
• Same command at 21:12Z and 21:19Z succeeded. By 21:43Z stable/…tar.gz hashed to 4fd0b598… and stable/…tar.gz.sha256 said the same, so the alias had converged (by then pointing at 20260901.212427.0-sha.138e51f5).
• Any CI that installs stable unpinned hits this every time a release lands: it took out every PR run of our compliance job for that window.

Why the installer can avoid it entirely

install.sh already learns the concrete release: after the tarball download it calls release_version_from_url "$DOWNLOADED_URL" to fetch github.com/swamp-club/swamp/releases/download/v$release_version/checksums.txt. The per-release objects (swamp/<version>/binary/<os>/<arch>/<asset>.sha256) are immutable, so the fix is to verify against the resolved version's .sha256 (or only the GitHub checksums.txt) instead of the alias's .sha256. That removes the race from the client side regardless of how the alias is published.

Publisher-side alternatives if the alias .sha256 must stay: write the .sha256 before flipping the tarball redirect and make the redirect target + checksum a single object (a small JSON manifest at stable/…/manifest.json with {version, sha256}), so a reader can never see them torn.

Workaround we use

Retry the installer a few times with a delay; the window closes on its own within minutes. (umag/swamp-workspace#218)