Package Download Checksum Guard - Claude Code Hook

mkdir -p .claude/hooks
cat > .claude/hooks/package-download-checksum-guard.sh <<'HOOK'
#!/usr/bin/env bash
set -u

# Claude Code PreToolUse hook for Bash. It looks for curl/wget commands that
# download packages, installers, or archives, and blocks the command unless
# the same proposed command also includes a checksum check or signature
# verification command. It reads the proposed command only; it never downloads
# anything.

if ! command -v jq >/dev/null 2>&1; then
  exit 0
fi

input=$(cat)
tool_name=$(printf '%s' "$input" | jq -r '.tool_name // .toolName // empty')
command_text=$(printf '%s' "$input" | jq -r '.tool_input.command // .toolInput.command // empty')

case "$tool_name" in
  Bash|bash) ;;
  *) exit 0 ;;
esac

if [ -z "$command_text" ]; then
  exit 0
fi

if [ -n "${PACKAGE_DOWNLOAD_GUARD_ALLOWLIST:-}" ]; then
  if printf '%s\n' "$command_text" | grep -Eq -- "$PACKAGE_DOWNLOAD_GUARD_ALLOWLIST"; then
    exit 0
  fi
fi

strip_shell_comments() {
  local text=$1
  local out=""
  local char=""
  local in_single=0
  local in_double=0
  local escaped=0
  local at_word_start=1
  local i=0

  while [ "$i" -lt "${#text}" ]; do
    char=${text:i:1}

    if [ "$escaped" -eq 1 ]; then
      out+="$char"
      at_word_start=0
      escaped=0
      i=$((i + 1))
      continue
    fi

    if [ "$char" = "\\" ] && [ "$in_single" -eq 0 ]; then
      out+="$char"
      at_word_start=0
      escaped=1
      i=$((i + 1))
      continue
    fi

    if [ "$char" = "'" ] && [ "$in_double" -eq 0 ]; then
      if [ "$in_single" -eq 1 ]; then
        in_single=0
      else
        in_single=1
      fi
      out+="$char"
      at_word_start=0
      i=$((i + 1))
      continue
    fi

    if [ "$char" = '"' ] && [ "$in_single" -eq 0 ]; then
      if [ "$in_double" -eq 1 ]; then
        in_double=0
      else
        in_double=1
      fi
      out+="$char"
      at_word_start=0
      i=$((i + 1))
      continue
    fi

    if [ "$char" = "#" ] && [ "$in_single" -eq 0 ] && [ "$in_double" -eq 0 ] && [ "$at_word_start" -eq 1 ]; then
      while [ "$i" -lt "${#text}" ] && [ "$char" != $'\n' ]; do
        i=$((i + 1))
        char=${text:i:1}
      done
      continue
    fi

    out+="$char"

    if [ "$in_single" -eq 0 ] && [ "$in_double" -eq 0 ]; then
      case "$char" in
        [[:space:]]|";"|"&"|"|"|"("|")") at_word_start=1 ;;
        *) at_word_start=0 ;;
      esac
    fi

    i=$((i + 1))
  done

  printf '%s\n' "$out"
}

# Remove only real shell comments before matching policy tokens. This keeps a
# comment such as `# sha256sum -c` from being treated as verification without
# truncating quoted or escaped # characters that are part of the command.
command_without_comments=$(strip_shell_comments "$command_text")

downloader_a='curl'
downloader_b='wget'
shell_a='sh'
shell_b='bash'
shell_c='zsh'
pipe_char=$(printf '\174')
downloader_names="(${downloader_a}${pipe_char}${downloader_b})"
shell_names="(${shell_a}${pipe_char}${shell_b}${pipe_char}${shell_c})"
downloader_re="(^|[;&${pipe_char}[:space:]])${downloader_names}([[:space:]]|$)"
archive_re='https?://[^[:space:]]*(\.zip|\.tar\.gz|\.tgz|\.tar\.xz|\.tar\.bz2|\.mcpb|\.deb|\.rpm|\.pkg|\.dmg|\.exe|\.msi|\.AppImage|install\.sh|setup\.sh|bootstrap\.sh)([?#][^[:space:]]*)?'
pipe_installer_re="${downloader_names}[^${pipe_char}]*https?://[^${pipe_char}[:space:]]*(install|setup|bootstrap|\.sh)[^${pipe_char}]*\\${pipe_char}[[:space:]]*(sudo[[:space:]]+)?${shell_names}"
command_chain_re='(^|&&)'
checksum_re='(sha256sum[[:space:]][^;&|#]*(--check|-c)|shasum[[:space:]][^;&|#]*(-a[[:space:]]+256|--algorithm([=[:space:]]+)256)[^;&|#]*(--check|-c))'
signature_re='(cosign[[:space:]]+verify-blob|gpg[[:space:]][^;&|#]*--verify|minisign[[:space:]][^;&|#]*-V)'
verification_command_re="${command_chain_re}[[:space:]]*(${checksum_re}|${signature_re})[^;&|#]*"

escape_ere() {
  printf '%s' "$1" | sed -E 's/[][(){}.^$*+?|\]/\\&/g'
}

has_verification_for_download() {
  urls=$(printf '%s\n' "$command_without_comments" | grep -Eo -- "$archive_re" || true)
  [ -n "$urls" ] || return 1

  while IFS= read -r url; do
    [ -n "$url" ] || continue
    clean_url=$(printf '%s\n' "$url" | sed -E 's/[?#].*$//')
    artifact=${clean_url##*/}
    [ -n "$artifact" ] || continue
    artifact_re=$(escape_ere "$artifact")
    after_url=$(printf '%s\n' "$command_without_comments" | awk -v u="$url" '
      found { print }
      !found {
        index_at = index($0, u)
        if (index_at > 0) {
          print substr($0, index_at + length(u))
          found = 1
        }
      }
    ')
    artifact_verification_re="${verification_command_re}${artifact_re}[^;&|#]*($|&&)"
    if printf '%s\n' "$after_url" | grep -Eq -- "$artifact_verification_re"; then
      return 0
    fi
  done <<EOF
$urls
EOF

  return 1
}

if ! printf '%s\n' "$command_without_comments" | grep -Eq -- "$downloader_re"; then
  exit 0
fi

risky_download=0
if printf '%s\n' "$command_without_comments" | grep -Eq -- "$archive_re"; then
  risky_download=1
fi

pipe_installer=0
if printf '%s\n' "$command_without_comments" | grep -Eq -- "$pipe_installer_re"; then
  risky_download=1
  pipe_installer=1
fi

if [ "$risky_download" -ne 1 ]; then
  exit 0
fi

if [ "$pipe_installer" -eq 1 ]; then
  echo "Package download checksum guard: downloader-to-shell installer pipelines must be downloaded, verified, and run as separate steps." >&2
  echo "Download the script to a file, verify it with 'sha256sum -c', 'shasum -a 256 -c', 'cosign verify-blob', 'gpg --verify', or 'minisign -V', then run the reviewed file." >&2
  echo "Set PACKAGE_DOWNLOAD_GUARD_MODE=advisory to warn without blocking, or PACKAGE_DOWNLOAD_GUARD_ALLOWLIST to allow a reviewed command pattern." >&2
  if [ "${PACKAGE_DOWNLOAD_GUARD_MODE:-block}" = "advisory" ]; then
    exit 0
  fi
  exit 2
fi

if has_verification_for_download; then
  exit 0
fi

echo "Package download checksum guard: archive or installer download has no checksum/signature verification step." >&2
echo "Add verification such as 'sha256sum -c', 'shasum -a 256 -c', 'cosign verify-blob', 'gpg --verify', or 'minisign -V' before using the downloaded artifact." >&2
echo "Set PACKAGE_DOWNLOAD_GUARD_MODE=advisory to warn without blocking, or PACKAGE_DOWNLOAD_GUARD_ALLOWLIST to allow a reviewed command pattern." >&2

if [ "${PACKAGE_DOWNLOAD_GUARD_MODE:-block}" = "advisory" ]; then
  exit 0
fi

exit 2
HOOK
chmod +x .claude/hooks/package-download-checksum-guard.sh

mkdir -p .claude/hooks && touch .claude/hooks/lockfile-provenance-checker.sh && chmod +x .claude/hooks/lockfile-provenance-checker.sh

mkdir -p .claude/hooks && touch .claude/hooks/ort-dependency-license-checker.sh && chmod +x .claude/hooks/ort-dependency-license-checker.sh

mkdir -p .claude/hooks && install -m 0755 .claude/hooks/package-lock-risk-detector.sh .claude/hooks/