An archive per machine, and a checksum the installer will not skip.

# The checksum line for this tarball, out of the release's SHA256SUMS.
# Releases before 0.12.0 published none, and that is said rather than
# passed over: an install that was not verified should know it was not.
if curl -fsSL -o "$tmp/SHA256SUMS" "$base/SHA256SUMS" 2>/dev/null; then
  expected="$(awk -v name="$asset" '$2 == name || $2 == "*" name { print $1; exit }' "$tmp/SHA256SUMS")"
  [ -n "$expected" ] || die "the release's SHA256SUMS has no line for $asset"
  if command -v sha256sum >/dev/null 2>&1; then
    actual="$(sha256sum "$tmp/$asset" | awk '{ print $1 }')"
  elif command -v shasum >/dev/null 2>&1; then
    actual="$(shasum -a 256 "$tmp/$asset" | awk '{ print $1 }')"
  else
    die "the release publishes a checksum and neither sha256sum nor shasum is here to check it"
  fi
  [ "$actual" = "$expected" ] ||
    die "$asset does not match the release's SHA256SUMS: expected $expected, got $actual. Nothing was unpacked; try again, and if it repeats, say so at https://github.com/$repo/issues"
  say "verified: sha256 $actual"
else
  say "note: release $version publishes no SHA256SUMS; the tarball was not verified"
fi

# The checksum, and no way past it. `install.sh` carries a note for
# releases before 0.12.0, which published none; the Windows zip is
# published from 0.13.0 on and every one of those has a SHA256SUMS, so a
# missing one here is a broken release rather than an old one, and what
# comes out of this file reaches a linker.
$sums = Join-Path $Temp 'SHA256SUMS'
if (-not (Fetch 'SHA256SUMS' $sums -Optional)) {
    Die "release $Version publishes no SHA256SUMS, and an unverified zip is not unpacked"
}

$expected = $null
foreach ($line in [IO.File]::ReadAllLines($sums)) {
    $fields = $line.Trim() -split '\s+', 2
    if ($fields.Count -eq 2 -and $fields[1].TrimStart('*') -eq $Asset) { $expected = $fields[0].ToLower() }
}
if (-not $expected) { Die "the release's SHA256SUMS has no line for $Asset" }

$actual = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash.ToLower()
if ($actual -ne $expected) {
    Die ("$Asset does not match the release's SHA256SUMS: expected $expected, got $actual. " +
         "Nothing was unpacked; try again, and if it repeats, say so at https://github.com/$Repo/issues")
}
Say "verified: sha256 $actual"

case "$os-$arch" in
  Linux-x86_64) target=linux-x86_64 ;;
  Darwin-arm64) target=darwin-arm64 ;;
  *) die "no release for $os $arch: releases ship linux-x86_64 and darwin-arm64, see README.md (Getting it) to build from source" ;;
esac

# IYI_PREFIX       where to unpack, default ~/.local; the tarball is relocatable
# IYI_VERSION      a release to pin, e.g. 0.18.0; default is the latest release
# IYI_RELEASE_URL  where the release's files are, default the GitHub release;
#                  CI points it at a directory (file://) to install a tarball
#                  before it is released, which is how this script is gated