From 9e9ff35d134becccb6b6a8b71bc2c205bd8f9993 Mon Sep 17 00:00:00 2001
From: Oscar Wallberg <oscar.wallberg@outlook.com>
Date: Fri, 26 Jun 2026 03:17:08 +0200
Subject: [PATCH] fix: verify against upstream manifest

---
 .gitignore |  1 +
 PKGBUILD   | 19 +++++++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 0c14a91..dea7675 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,4 @@
 /claude-code-*.tgz
 /claude-code-*.pkg.tar*
 /claude-code-*.src.tar*
+/manifest.json
diff --git a/PKGBUILD b/PKGBUILD
index ecb0e9c..8748778 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -10,11 +10,26 @@ options=('!strip')
 provides=('claude')
 conflicts=('claude')
 
-source=("claude::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-x64/claude"
+source=("manifest.json::https://downloads.claude.ai/claude-code-releases/${pkgver}/manifest.json"
+        "claude::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-x64/claude"
         "claude.sh")
-sha256sums=('c9f04d929f18bd9a101f3897f27de4e1e0f15ebe8400d4aaf02983d73dd66b1d'
+sha256sums=('SKIP'
+            'SKIP'
             'd4f14ff492a181c59f42b32cf97d8682801d77ae7be0a96f5730c22755dd16c0')
 
+check() {
+    local manifest
+    manifest=$(< manifest.json)
+    [[ $manifest =~ \"linux-x64\"[^}]*\"checksum\":[[:space:]]*\"([a-f0-9]{64})\" ]]
+    local expected="${BASH_REMATCH[1]}"
+    local actual
+    actual=$(sha256sum claude | cut -d' ' -f1)
+    if [[ "$actual" != "$expected" ]]; then
+        error "Binary checksum mismatch: got $actual, manifest has $expected"
+        return 1
+    fi
+}
+
 package() {
     install -Dm755 claude "${pkgdir}/usr/lib/claude-code/claude"
     install -Dm755 claude.sh "${pkgdir}/usr/bin/claude"