From 1f19393e05da98c28a3150498f20c3970ed0f04c Mon Sep 17 00:00:00 2001
From: xingzihai <1315258019@qq.com>
Date: Sun, 29 Mar 2026 19:43:11 +0000
Subject: [PATCH] fix(installer): skip checksum verification for custom
 download URLs

When using a custom download URL (via env var), the checksum verification
should be skipped because the checksum in the manifest is for the original
binary, not the custom URL's binary.

Issue: #18736
---
 cargo-dist/templates/installer/installer.sh.j2 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/cargo-dist/templates/installer/installer.sh.j2 b/cargo-dist/templates/installer/installer.sh.j2
index 66efa6b2d..f44a7c457 100644
--- a/cargo-dist/templates/installer/installer.sh.j2
+++ b/cargo-dist/templates/installer/installer.sh.j2
@@ -309,7 +309,10 @@ download_binary_and_run_installer() {
             continue
         fi
 
-        if [ -n "${_checksum_style:-}" ]; then
+        {# Skip checksum verification when using a custom download URL #}
+        if [ -n "{{ '${' }}{{ env_vars.download_url_env_var }}:-}" ] || [ -n "${INSTALLER_DOWNLOAD_URL:-}" ]; then
+            say "skipping checksum verification (using custom download URL)" 1>&2
+        elif [ -n "${_checksum_style:-}" ]; then
             verify_checksum "$_file" "$_checksum_style" "$_checksum_value"
         else
             say "no checksums to verify" 1>&2