fix: verify Cloudsmith downloads at the raw versions path

.github/workflows/release.yml

@@ -293,12 +293,13 @@ jobs:
           set -eu
           VERSION="${TAG#v}"
           for file in cli.sh cli.ps1 SHA256SUMS; do
-            url="https://dl.cloudsmith.io/public/$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO/raw/names/$file/versions/$VERSION/$file"
-            expected="$(sha256sum "$file" | awk '{print $1}')"
-            if ! actual="$(curl -fsSL "$url" | sha256sum | awk '{print $1}')"; then
+            url="https://dl.cloudsmith.io/public/$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO/raw/versions/$VERSION/$file"
+            if ! curl -fsSL "$url" -o "verify-$file"; then
               echo "notice: could not download $url (repository may still be private); skipping verification"
               continue
             fi
+            expected="$(sha256sum "$file" | awk '{print $1}')"
+            actual="$(sha256sum "verify-$file" | awk '{print $1}')"
             if [ "$expected" != "$actual" ]; then
               echo "checksum mismatch for $url" >&2
               exit 1

CHANGELOG.md

@@ -7,18 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- The release workflow verifies the published Cloudsmith files at their
+  actual download path (`raw/versions/<version>/<file>`), and a failed
+  download is reported as a notice instead of a spurious checksum mismatch.
+
+## [0.1.0] - 2026-07-30
+
 ### Added
 
 - Release workflow job publishing the install scripts to Cloudsmith as
   `cli.sh` and `cli.ps1` (with `SHA256SUMS`), gated on configuration and
   authenticated via the CLI's GitHub Actions OIDC exchange. Served at
-  `https://install.cloudsmith.com/raw/files/cli.<sh|ps1>`.
+  `https://install.cloudsmith.com/raw/versions/latest/cli.<sh|ps1>`.
 - README instructions for installing from the published Cloudsmith URLs.
-
-## [0.1.0] - 2026-07-16
-
-### Added
-
 - Cross-platform `install.sh` and `install.ps1` installers for the standalone
   Cloudsmith CLI.
 - Automatic platform detection, including native Arm64 selection under

README.md

@@ -64,20 +64,20 @@ Tagged releases are also published to Cloudsmith as `cli.sh` and `cli.ps1`,
 served at stable short URLs. Install the latest CLI with one command:
 
 ```sh
-curl -fsSL https://install.cloudsmith.com/raw/files/cli.sh | sh
+curl -fsSL https://install.cloudsmith.com/raw/versions/latest/cli.sh | sh
 ```
 
 ```powershell
-irm https://install.cloudsmith.com/raw/files/cli.ps1 | iex
+irm https://install.cloudsmith.com/raw/versions/latest/cli.ps1 | iex
 ```
 
 Both scripts install the latest CLI version by default and print the
 installed `bin_dir` to add to `PATH`.
 
 To verify before running, or to pin a version, download the script and
 `SHA256SUMS` from
-`https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names/<name>/versions/<version|latest>/<name>`
-where `<name>` is `cli.sh`, `cli.ps1`, or `SHA256SUMS`, then run it with
+`https://install.cloudsmith.com/raw/versions/<version|latest>/<file>`
+where `<file>` is `cli.sh`, `cli.ps1`, or `SHA256SUMS`, then run it with
 `--version X.Y.Z` (`-Version X.Y.Z` in PowerShell). Use pinned, verified
 downloads in CI.