docs: Document SHA-256 checksum verification for the runpodctl install script and self-update

[promptless]

Open this suggestion in Promptless to view citations and reasoning process

runpod/runpodctl PR #303 added fail-closed SHA-256 checksum verification to both user-facing paths that download the CLI, so this suggestion documents both:

• Install script (runpodctl/overview.mdx): a note on the "Install script" tab explaining that the script verifies the downloaded release against its SHA-256 checksum before installing, and so needs sha256sum (Linux) or shasum (macOS) to be present. These are preinstalled in most environments, but the install aborts on minimal images without one.
• Self-update (runpodctl/reference/runpodctl-update.mdx): a note that runpodctl update verifies the downloaded release against its SHA-256 checksum before replacing the installed binary, that verification always runs, and that a failed check aborts the update and leaves the existing binary in place. This path computes the checksum in-process, so it needs no external checksum tool.

Trigger Events

• runpod/runpodctl PR #303: fix: verify self-update archive checksums

---

Tip: Tag @Promptless in GitHub PR comments to guide documentation changes during code review 🐙

[promptless]

(Line 44)

PR #303 added SHA-256 checksum verification to install.sh before extraction; its calculate_sha256 helper uses sha256sum or shasum and fails closed with "No SHA-256 checksum tool found" when neither is present, and the new header requirement notes sha256sum on Linux or shasum on macOS. This note documents that new prerequisite.

Source: runpod/runpodctl#303

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
runpod-docs	🟢 Ready	View Preview	Jul 14, 2026, 1:24 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
runpod-docs	🟡 Building	–	Jul 14, 2026, 1:23 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[lavanya-gunreddi]

@Promptless the triggered PR is merged. Check if all the changes have been added to the docs.

[promptless]

Thanks! Since runpod/runpodctl #303 is now merged, I'm reviewing the docs to confirm all of its user-facing changes are captured here. I'll follow up with what's covered and anything still needed.

[promptless]

Update: research is done. The note in this PR accurately covers the install-script checksum requirement (both Linux and macOS). One gap turned up — the runpodctl update self-update command also gained checksum verification in #303, but the update reference page doesn't mention it yet. I'm scoping that follow-up now.

[promptless]

Scoped: only the runpodctl update reference page needs the addition (a brief note that self-update now verifies the release checksum before replacing the binary — no extra tooling required there). I'm adding that to this PR now; the existing install-script note stays as-is.

[promptless]

PR #303 added self-update checksum verification in cmd/update.go: the update command downloads the release archive and its checksums_<version>_sha256.txt asset (via DownloadBytes/findAsset), then calls verifyArchiveChecksum (verifyFileChecksum, using stdlib crypto/sha256) before extracting/installing the new binary. Verification always runs (no flag or env var to skip it); on failure (missing checksum asset, malformed digest, or mismatch) the update returns an error before the existing binary is replaced.

Source: https://github.com/runpod/runpodctl/blob/c05a2bb71b5cf736b0477e0531f66027dc88cfc6/cmd/update.go#L289

[promptless]

Thanks for flagging this. runpodctl PR #303 actually changed two things users touch: the install script and the runpodctl update self-update command. This PR already covered the install script, but the self-update command page didn't mention the new checksum check — so we've updated the PR to document both.

It now explains that runpodctl update verifies the downloaded release against its SHA-256 checksum before replacing your binary and aborts if the check fails (this path needs no extra tools), alongside the existing install-script note.

One heads-up: this PR is still open (not yet merged) on our side — the merged change is the upstream runpodctl#303. Once this PR merges, the docs will fully reflect PR #303.