Verify installer SHA256 after download (#5224)

* Verify installer SHA256 after download

The Windows installer was downloading and launching new installer updates
without verifying the SHA256 hash, which could allow a corrupted or
tampered installer to run. This adds SHA256 verification after download
and before launching the new installer.

- Add expectedSha parameter to DownloadAndLaunchNewInstaller
- Compute SHA256 of downloaded file and compare to manifest value
- Delete the file and fail if SHA doesn't match
- Log verification success on match

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Remove accidentally committed node_modules cache files

* Add node_modules to .gitignore

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

.gitignore

@@ -38,3 +38,4 @@ scripts/refresh_name_layers/refresh_name_layers.zip
 api_keys.txt
 
 src/main/csharp/net/eagle0/clients/unity/eagle0/ProjectSettings/Packages/com.unity.dedicated-server/
+node_modules/

src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/EagleUpdater.cs

@@ -347,7 +347,9 @@ namespace EagleInstaller {
             } finally { Pool.Release(); }
         }
 
-        public async Task<bool> DownloadAndLaunchNewInstaller(string installerUrl) {
+        public async Task<bool> DownloadAndLaunchNewInstaller(
+                string installerUrl,
+                string expectedSha) {
             try {
                 Logger.UpdateStatus("Downloading new installer...");
 
@@ -397,6 +399,28 @@ namespace EagleInstaller {
                     }
                 }
 
+                // Verify SHA256 before launching
+                Logger.UpdateStatus("Verifying installer integrity...");
+                string computedSha;
+                using (var sha256 = System.Security.Cryptography.SHA256.Create()) using (
+                        var stream = File.OpenRead(newInstallerPath)) {
+                    var hashBytes = sha256.ComputeHash(stream);
+                    computedSha =
+                            BitConverter.ToString(hashBytes).Replace("-", string.Empty).ToLower();
+                }
+
+                if (!computedSha.Equals(expectedSha, StringComparison.OrdinalIgnoreCase)) {
+                    Logger.WriteError($"SECURITY ERROR: Installer SHA mismatch!");
+                    Logger.WriteError($"  Expected: {expectedSha}");
+                    Logger.WriteError($"  Got:      {computedSha}");
+                    // Delete the corrupted/tampered file
+                    try {
+                        File.Delete(newInstallerPath);
+                    } catch {}
+                    return false;
+                }
+                Logger.WriteLine($"✓ Installer verified: SHA256 matches");
+
                 // Wait a moment to ensure file handles are released
                 await Task.Delay(500);
 

src/main/csharp/net/eagle0/clients/win/installer/EagleInstaller/Program.cs

@@ -110,7 +110,8 @@ namespace EagleInstaller {
                 if (installerUpdateInfo.InstallerNeedsUpdate) {
                     Logger.UpdateStatus("Installer update required...");
                     bool downloadSuccess = await updater.DownloadAndLaunchNewInstaller(
-                            installerUpdateInfo.NewInstallerUrl);
+                            installerUpdateInfo.NewInstallerUrl,
+                            installerUpdateInfo.NewInstallerVersion);
                     if (downloadSuccess) {
                         Logger.UpdateStatus("New installer launched. Exiting current version.");