The plugin's first-run bootstrap (hooks/bootstrap.sh) and the install one-liner the site serves (site-src/install.sh.tmpl) download an abcd binary and check it only against checksums.txt from the same release page, the weakness iss-2609231050273096 fixed for abcd update in Go. A shell script cannot run the in-process provenance check, so the fix needs a design choice (for example: verify with gh attestation verify when gh is present and refuse or warn without it; or verify with a previously installed, already-verified abcd). Found by the E5 fix lane on 2026-10-12.

Frontmatter

.abcd/work/issues/resolved/iss-2610120617521209-bootstrap-and-installer-trust-same-page.md
open on GitHub ↗ · commit history ↗

mentions1

• iss-2609231050273096abcd update verifies a downloaded binary only against the checksums.txt published in the same GitHub release (internal/core/update/update.go), so it catches corruption in transit but not a release page whose binary and checksums.txt were both replaced; the binary needs an independent check next cycle, such as a digest committed in the repository's history the way the plugin catalog now pins the plugin archive (adr-2609231048308186), or verification of the release's signed build-provenance attestation (a new verification dependency needs sign-off first). Ruled by the product thinker on 2026-09-23 (E5, 10:27Z): harden next cycle; this release keeps the same-page check.