docs: install page checksum signature check (#5473)

* docs: install page checksum file check

* docs: update install tab

* backend docs update

Author: denis256

docs-starlight/src/components/InstallTab.astro

@@ -15,21 +15,36 @@ $version = "${version}"
 $binaryName = "terragrunt_\${os}_\${arch}.exe"
 try {
     $ProgressPreference = 'SilentlyContinue'
-    # Download binary and checksum
     $baseUrl = "https://github.com/gruntwork-io/terragrunt/releases/download/$version"
     Write-Host "Downloading Terragrunt $version..."
     Invoke-WebRequest -Uri "$baseUrl/$binaryName" -OutFile $binaryName -UseBasicParsing
     Invoke-WebRequest -Uri "$baseUrl/SHA256SUMS" -OutFile "SHA256SUMS" -UseBasicParsing
+    Invoke-WebRequest -Uri "$baseUrl/SHA256SUMS.gpgsig" -OutFile "SHA256SUMS.gpgsig" -UseBasicParsing
+
+    # First: Verify GPG signature of checksum file (requires gpg installed)
+    Write-Host "Importing Gruntwork signing key..."
+    Invoke-WebRequest -Uri "https://gruntwork.io/.well-known/pgp-key.txt" -OutFile "pgp-key.txt" -UseBasicParsing
+    gpg --import pgp-key.txt 2>$null
+    Write-Host "Verifying GPG signature of SHA256SUMS..."
+    gpg --verify SHA256SUMS.gpgsig SHA256SUMS
+    if ($LASTEXITCODE -ne 0) {
+        Write-Error "GPG signature verification failed"
+        exit 1
+    }
+    Write-Host "GPG signature verified!"
+
+    # Second: Verify checksum of binary against trusted SHA256SUMS
     $actualChecksum = (Get-FileHash -Algorithm SHA256 $binaryName).Hash.ToLower()
     $expectedChecksum = (Get-Content "SHA256SUMS" | ForEach-Object { $parts = $_ -split '\s+'; if ($parts[1] -eq $binaryName) { return $parts[0].ToLower() } } | Select-Object -First 1)
     if ($actualChecksum -ne $expectedChecksum) {
         Write-Error "Checksum verification failed"
         exit 1
     }
-    Write-Host "Terragrunt $version has been downloaded and verified successfully"
+    Write-Host "Checksum verified!"
+    Write-Host "Terragrunt $version downloaded and verified successfully"
 }
 catch {
-    Write-Error "Failed to download: $_"
+    Write-Error "Failed: $_"
     exit 1
 }
 finally {
@@ -51,25 +66,33 @@ OS="${os}"
 ARCH="${arch}"
 VERSION="${version}"
 BINARY_NAME="terragrunt_\${OS}_\${ARCH}"
+BASE_URL="https://github.com/gruntwork-io/terragrunt/releases/download/\$VERSION"
 
-# Download the binary
-curl -sL "https://github.com/gruntwork-io/terragrunt/releases/download/\$VERSION/\$BINARY_NAME" -o "\$BINARY_NAME"
-
-# Generate the checksum
-CHECKSUM="\$(${os == 'linux' ? 'sha256sum' : 'shasum -a 256'} "\$BINARY_NAME" | awk '{print \$1}')"
+# Download binary and verification files
+curl -sL "\$BASE_URL/\$BINARY_NAME" -o "\$BINARY_NAME"
+curl -sL "\$BASE_URL/SHA256SUMS" -o SHA256SUMS
+curl -sL "\$BASE_URL/SHA256SUMS.gpgsig" -o SHA256SUMS.gpgsig
 
-# Download the checksum file
-curl -sL "https://github.com/gruntwork-io/terragrunt/releases/download/\$VERSION/SHA256SUMS" -o SHA256SUMS
+# First: Import Gruntwork signing key and verify GPG signature of checksum file
+curl -s https://gruntwork.io/.well-known/pgp-key.txt | gpg --import 2>/dev/null
+if gpg --verify SHA256SUMS.gpgsig SHA256SUMS 2>/dev/null; then
+  echo "GPG signature verified!"
+else
+  echo "GPG signature verification failed!"
+  exit 1
+fi
 
-# Grab the expected checksum (exact match on filename)
+# Second: Verify checksum of binary against trusted SHA256SUMS
+CHECKSUM="\$(${os == 'linux' ? 'sha256sum' : 'shasum -a 256'} "\$BINARY_NAME" | awk '{print \$1}')"
 EXPECTED_CHECKSUM="\$(awk -v binary="\$BINARY_NAME" '\$2 == binary {print \$1; exit}' SHA256SUMS)"
 
-# Compare the checksums
-if [ "\$CHECKSUM" == "\$EXPECTED_CHECKSUM" ]; then
- echo "Checksums match!"
-else
- echo "Checksums do not match!"
-fi`}
+if [ "\$CHECKSUM" != "\$EXPECTED_CHECKSUM" ]; then
+  echo "Checksum verification failed!"
+  exit 1
+fi
+echo "Checksum verified!"
+
+echo "Terragrunt \$VERSION downloaded and verified successfully"`}
   frame='terminal'
 	>
 </Code>

docs-starlight/src/content/docs/01-getting-started/03-install.mdx

@@ -27,11 +27,12 @@ Run `curl -sL https://terragrunt.gruntwork.io/install | bash -s -- --help` to se
 ## Download from releases page
 
 1. Go to the [Releases Page](https://github.com/gruntwork-io/terragrunt/releases).
-2. Download the binary for your operating system: e.g., if you're on a Mac, download `terragrunt_darwin_amd64`; if you're on Windows, download `terragrunt_windows_amd64.exe`, etc.
-3. Optionally, follow the instructions below on [verifying the checksum](#verifying-the-checksum).
-4. Rename the downloaded file to `terragrunt`.
-5. Add execute permissions to the binary: e.g., On Linux and Mac: `chmod u+x terragrunt`.
-6. Put the binary somewhere on your `PATH`: e.g., On Linux and Mac: `mv terragrunt /usr/local/bin/terragrunt`.
+2. Download the archive for your operating system: e.g., if you're on a Mac, download `terragrunt_darwin_amd64.tar.gz`; if you're on Windows, download `terragrunt_windows_amd64.exe.zip`, etc.
+3. Download `SHA256SUMS` and optionally `SHA256SUMS.gpgsig` for signature verification.
+4. Verify the checksum and optionally the signature (see [Verifying the checksum](#verifying-the-checksum) below).
+5. Extract the archive: e.g., `tar -xzf terragrunt_darwin_amd64.tar.gz` or unzip on Windows.
+6. Add execute permissions to the binary (Linux/Mac): `chmod u+x terragrunt`.
+7. Put the binary somewhere on your `PATH`: e.g., On Linux and Mac: `mv terragrunt /usr/local/bin/terragrunt`.
 
 ### Verifying the checksum
 
@@ -54,6 +55,21 @@ curl -s https://gruntwork.io/.well-known/pgp-key.txt | gpg --import
 gpg --verify SHA256SUMS.gpgsig SHA256SUMS
 ```
 
+:::caution[Verify Key Fingerprint]
+After importing the key, verify its fingerprint matches exactly:
+
+```bash
+gpg --fingerprint 577774ACA847CC49
+```
+
+Expected output:
+```
+pub   ed25519 2026-01-12 [SC]
+      68C8 0F86 DF98 E710 C0F2  2E2E 5777 74AC A847 CC49
+uid           [ unknown] Gruntwork (Code Signing Key) <security@gruntwork.io>
+```
+:::
+
 7. Alternatively, verify with Cosign:
 
 ```bash
@@ -68,6 +84,10 @@ cosign verify-blob SHA256SUMS \
 
 <InstallTabs version={version} />
 
+:::note
+These scripts automatically verify the SHA256 checksum and GPG signature before completing.
+:::
+
 ## Install via a package manager
 
 Note that all the different package managers are third party. The third party Terragrunt packages may not be updated with the latest version, but are often close. Please check your version against the latest available on the [Releases Page](https://github.com/gruntwork-io/terragrunt/releases).
@@ -138,15 +158,10 @@ Colleagues and CI/CD pipelines can then install the associated tool manager, and
 
 Note that the tools Terragrunt integrates with, such as OpenTofu and Terraform, can also be managed by these tool managers, so you can also pin the versions of those tools in the same file.
 
-Also note that the asdf plugin that `asdf` relies on is maintained by a third party:
-
-https://github.com/ohmer/asdf-terragrunt
+**Backend details:**
 
-Gruntwork makes no guarantees about the safety or reliability of third-party plugins.
-
-The asdf plugin relied upon by `mise` is maintained by Gruntwork, as requested by the community:
-
-https://github.com/gruntwork-io/asdf-terragrunt
+- **mise** uses [aqua](https://aquaproj.github.io/) as its default backend to install Terragrunt.
+- **asdf** uses the asdf-terragrunt plugin, which is maintained by Gruntwork: https://github.com/gruntwork-io/asdf-terragrunt
 
 ## Building from source
 
@@ -183,12 +198,12 @@ terragrunt --install-autocomplete
 
 Once the autocomplete support is installed, you will need to restart your shell.
 
+## Gruntwork Pipelines
+
+Gruntwork offers a commercial CI/CD solution for Terragrunt called [Pipelines](https://www.gruntwork.io/platform/pipelines). Pipelines is a fully managed CI/CD service that is designed to work seamlessly with Terragrunt. It provides an out of the box solution for running Terragrunt in CI/CD without the need to setup and maintain your own CI/CD infrastructure.
+
 ## Terragrunt GitHub Action
 
 Terragrunt is also available as a GitHub Action.
 
 Instructions on how to use it can be found at [https://github.com/gruntwork-io/terragrunt-action](https://github.com/gruntwork-io/terragrunt-action).
-
-## Gruntwork Pipelines
-
-Gruntwork offers a commercial CI/CD solution for Terragrunt called [Pipelines](https://www.gruntwork.io/platform/pipelines). Pipelines is a fully managed CI/CD service that is designed to work seamlessly with Terragrunt. It provides an out of the box solution for running Terragrunt in CI/CD without the need to setup and maintain your own CI/CD infrastructure.