* Verify drone-ssh binary checksum after download
Download checksums.txt from the drone-ssh release alongside the binary and verify it. Protects against tampered or corrupted release artifacts.
* refactor: make checksum verification portable across minimal containers
- Detect shasum (Perl) or sha256sum (coreutils/busybox) and fall back
gracefully; warn and skip verification only when neither tool exists,
so container jobs without perl are not broken
- Look up the exact checksums.txt entry for the target binary and
compare hashes directly, avoiding the --ignore-missing flag that
busybox sha256sum does not support
- Fail closed when checksums.txt has no entry for the binary
- Remove checksums.txt after successful verification
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
