Verify the Electron download against Electron's published checksums

[jason-c-dev]

Thanks for this — I rebuilt Granola from a .dmg by hand following the six
steps in the README, specifically so I could satisfy myself the repo was safe
before running it. It reproduced exactly, and the write-up made that easy. Two
small things came out of the exercise.

The Electron runtime is downloaded but never verified

The script pulls a ~118 MB runtime and unpacks it straight into
$INSTALL_DIR. Electron publishes a SHASUMS256.txt next to every release, so
checking it costs one small extra request:

==> Fetching the Linux Electron runtime
    using cached electron-v42.7.0-linux-x64.zip
    sha256 verified against electron/electron SHASUMS256.txt

This felt worth doing here in particular. The repo's pitch is that the
conversion is trustworthy and auditable, and this is the one large unsigned
binary the process ingests.

Details:

• Verification runs against the cached zip as well as a fresh download, so
  a truncated file left behind by an interrupted run is caught instead of
  silently unpacked. That was the failure mode I actually wanted to guard
  against.
• A failed check deletes the zip, so re-running retries cleanly rather than
  failing forever against poisoned cache.
• It runs before rm -rf "$INSTALL_DIR", so a bad download can't take out
  a working install. That ordering was already correct — I just kept it.
• SHASUMS256.txt is cached per-version alongside the zip.

Prerequisites are apt-only

The install line assumes Debian/Ubuntu. Added Arch and Fedora equivalents.

Worth noting explicitly in the README: the existing command -v 7zz check
already prefers a system binary, so on distros packaging modern 7-Zip the
7-zip.org download never happens. Arch's 7zip is 26.02 — newer than the
bundled static 25.01 — and p7zip isn't in the Arch repos at all, so the
"most distros ship p7zip" caveat doesn't apply there. That removes a host from
the set the script talks to, which seemed worth stating outright.

Testing

Ran the patched script end-to-end on Arch (gcc 16, glibc 2.42) against Granola
7.522.2 / Electron 42.7.0 — full build, native rebuild, and smoke test pass.

Then corrupted a byte in the cached zip and re-ran to confirm it fails closed:

==> Fetching the Linux Electron runtime
    using cached electron-v42.7.0-linux-x64.zip
error: Electron runtime failed checksum verification (deleted; re-run to retry)

Exit status 1, zip removed, nothing installed.

I also added that Arch run to the "Tested on" list, since it's a different
distro and a newer Granola than the table had. Happy to drop that if you'd
rather keep it to configurations you've verified yourself.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EaTeCExac9ue2MGZt7LL8a