fix(scripts): improve checksum verification robustness against whitespace

scripts/install-container-agent.sh

@@ -514,6 +514,56 @@ download_agent() {
     exit 1
   fi
 
+  # Checksum verification
+  local checksum_url="${download_url}.sha256"
+  local expected_checksum=""
+  
+  # Try to fetch checksum
+  if command -v curl >/dev/null 2>&1; then
+      local curl_args=(-fsSL "$checksum_url")
+      if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+          curl_args=(-k "${curl_args[@]}")
+      fi
+      expected_checksum=$(curl "${curl_args[@]}" 2>/dev/null || true)
+  elif command -v wget >/dev/null 2>&1; then
+      local wget_args=(-qO- "$checksum_url")
+      if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+          wget_args=(--no-check-certificate "${wget_args[@]}")
+      fi
+      expected_checksum=$(wget "${wget_args[@]}" 2>/dev/null || true)
+  fi
+
+  if [[ -n "$expected_checksum" ]]; then
+      log_info "Verifying checksum..."
+      local actual_checksum=""
+      if command -v sha256sum >/dev/null 2>&1; then
+          actual_checksum=$(sha256sum "$tmp" | awk '{print $1}')
+      elif command -v shasum >/dev/null 2>&1; then
+          actual_checksum=$(shasum -a 256 "$tmp" | awk '{print $1}')
+      fi
+
+      if [[ -n "$actual_checksum" ]]; then
+          # Normalize checksums
+          local clean_expected
+          clean_expected=$(echo "$expected_checksum" | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
+          local clean_actual
+          clean_actual=$(echo "$actual_checksum" | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
+
+          if [[ "$clean_expected" != "$clean_actual" ]]; then
+              rm -f "$tmp"
+              log_error "Checksum mismatch."
+              log_error "  Expected: '$clean_expected'"
+              log_error "  Actual:   '$clean_actual'"
+              exit 1
+          fi
+          log_success "Checksum verified"
+      else
+          log_warn "Unable to calculate local checksum (sha256sum/shasum not found). Skipping verification."
+      fi
+  else
+      log_info "No checksum file found at $checksum_url. Skipping verification."
+  fi
+
   mv "$tmp" "$AGENT_PATH"
   chmod 0755 "$AGENT_PATH"
   log_success "Agent installed at $AGENT_PATH"

scripts/install-docker-agent-v2.sh

@@ -810,8 +810,11 @@ fetch_checksum_header() {
     fi
 
     local value
-    value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); print $2}')
+    value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); sub(/[[:space:]]*$/,"",$2); print $2}')
     value=$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')
+    # Extra trim to be safe
+    value=$(trim "$value")
+
     if [[ -z "$value" ]]; then
         return 1
     fi
@@ -856,9 +859,16 @@ verify_agent_checksum() {
         return 0
     fi
 
-    if [[ "$FETCHED_CHECKSUM" != "$CALCULATED_CHECKSUM" ]]; then
+    local clean_fetched
+    clean_fetched=$(echo "$FETCHED_CHECKSUM" | tr -d '[:space:]')
+    local clean_calculated
+    clean_calculated=$(echo "$CALCULATED_CHECKSUM" | tr -d '[:space:]')
+
+    if [[ "$clean_fetched" != "$clean_calculated" ]]; then
         rm -f "$AGENT_PATH"
-        log_error "Checksum mismatch. Expected $FETCHED_CHECKSUM but downloaded $CALCULATED_CHECKSUM"
+        log_error "Checksum mismatch."
+        log_error "  Expected: '$clean_fetched' (from header)"
+        log_error "  Actual:   '$clean_calculated' (calculated)"
         return 1
     fi
 

scripts/install-docker-agent.sh

@@ -1679,8 +1679,11 @@ fetch_checksum_header() {
     fi
 
     local value
-    value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); print $2}')
+    value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); sub(/[[:space:]]*$/,"",$2); print $2}')
     value=$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')
+    # Extra trim to be safe
+    value=$(trim "$value")
+
     if [[ -z "$value" ]]; then
         return 1
     fi
@@ -1719,9 +1722,16 @@ verify_agent_checksum() {
         return 0
     fi
 
-    if [[ "$(echo "$FETCHED_CHECKSUM" | tr -d '\r\n')" != "$(echo "$CALCULATED_CHECKSUM" | tr -d '\r\n')" ]]; then
+    local clean_fetched
+    clean_fetched=$(echo "$FETCHED_CHECKSUM" | tr -d '[:space:]')
+    local clean_calculated
+    clean_calculated=$(echo "$CALCULATED_CHECKSUM" | tr -d '[:space:]')
+
+    if [[ "$clean_fetched" != "$clean_calculated" ]]; then
         rm -f "$AGENT_PATH"
-        log_error "Checksum mismatch. Expected $FETCHED_CHECKSUM but downloaded $CALCULATED_CHECKSUM"
+        log_error "Checksum mismatch."
+        log_error "  Expected: '$clean_fetched' (from header)"
+        log_error "  Actual:   '$clean_calculated' (calculated)"
         return 1
     fi