install: read SHA256SUMS.txt first and fetch the archive by its checksum, past stale proxy caches

tools/release/install.ps1

@@ -22,11 +22,11 @@ if (-not $sums) { throw "release $which has no SHA256SUMS.txt" }
 $dir = Join-Path $env:TEMP ("aego-setup-" + [guid]::NewGuid())
 New-Item -ItemType Directory -Path $dir | Out-Null
 $zip = Join-Path $dir $setup.name
-Write-Host "Downloading $($setup.name)"
+$line = ((Invoke-WebRequest ($sums.browser_download_url + "?t=" + [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()) -UseBasicParsing).Content -split "`n") | Where-Object { $_ -match [regex]::Escape($setup.name) + '\s*$' } | Select-Object -First 1
-Invoke-WebRequest $setup.browser_download_url -OutFile $zip -UseBasicParsing
-$line = ((Invoke-WebRequest $sums.browser_download_url -UseBasicParsing).Content -split "`n") | Where-Object { $_ -match [regex]::Escape($setup.name) + '\s*$' } | Select-Object -First 1
 if (-not $line) { throw "SHA256SUMS.txt does not list $($setup.name)" }
 $want = ($line -split '\s+')[0]
+Write-Host "Downloading $($setup.name)"
+Invoke-WebRequest ($setup.browser_download_url + "?v=" + $want) -OutFile $zip -UseBasicParsing
 $got = (Get-FileHash $zip -Algorithm SHA256).Hash
 if ($want -ne $got) { Remove-Item -Recurse $dir; throw "checksum mismatch, refusing to install" }
 Expand-Archive $zip -DestinationPath $dir

tools/release/install.sh

@@ -55,13 +55,14 @@ url=$(printf '%s' "$json" | tr ',' '\n' | sed -n "s/.*\"browser_download_url\":\
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
 file="$tmp/$(basename "$url")"
-say "Downloading $url"
-curl -fSL --progress-bar -o "$file" "$url"
 sums=$(printf '%s' "$json" | tr ',' '\n' | sed -n 's/.*"browser_download_url":"\([^"]*\/SHA256SUMS\.txt\)".*/\1/p' | head -n 1)
 [ -n "$sums" ] || { say "install.sh: the release has no SHA256SUMS.txt"; exit 1; }
-curl -fsSL -o "$tmp/SHA256SUMS.txt" "$sums"
+curl -fsSL -o "$tmp/SHA256SUMS.txt" "$sums?t=$(date +%s)"
 want=$(grep " $(basename "$url")\$" "$tmp/SHA256SUMS.txt" | cut -d' ' -f1)
 [ -n "$want" ] || { say "install.sh: SHA256SUMS.txt does not list $(basename "$url")"; exit 1; }
+# the checksum in the URL keeps caching proxies from serving an earlier build under the same name
+say "Downloading $url"
+curl -fSL --progress-bar -o "$file" "$url?v=$want"
 if command -v sha256sum >/dev/null 2>&1; then
 	got=$(sha256sum "$file" | cut -d' ' -f1)
 else