v0.0.24 - Fix stale release installs by validating installer version and hardening release artifact build/version checks

increment_and_push.sh

@@ -153,14 +153,42 @@ git_commit_and_push_no_tag() {
     git push origin "$NEW_VERSION" || git push --force origin "$NEW_VERSION"
 }
 
+verify_binary_version() {
+    local bin_path="$1"
+    local expected="$2"
+
+    if [[ ! -x "$bin_path" ]]; then
+        print_error "Binary not found or not executable: $bin_path"
+        return 1
+    fi
+
+    local got
+    got="$($bin_path --version 2>/dev/null | awk '{print $2}')"
+    if [[ "$got" != "$expected" ]]; then
+        print_error "Binary version mismatch for $(basename "$bin_path"): expected $expected, got ${got:-<unknown>}"
+        return 1
+    fi
+
+    return 0
+}
+
 build_release_binary() {
     if [[ ! -f "build_static.sh" ]]; then
         print_error "build_static.sh not found"
         return 1
     fi
 
+    # Prevent stale artifacts from previous builds being uploaded.
+    rm -f build/nsigner_static_x86_64 build/nsigner_static_arm64
+
     ./build_static.sh > /dev/null 2>&1 || return 1
+    verify_binary_version "build/nsigner_static_x86_64" "$NEW_VERSION" || return 1
+
     ./build_static.sh --arch arm64 > /dev/null 2>&1 || print_warning "ARM64 build failed (continuing)"
+    if [[ -x "build/nsigner_static_arm64" ]]; then
+        verify_binary_version "build/nsigner_static_arm64" "$NEW_VERSION" || return 1
+    fi
+
     return 0
 }
 
@@ -253,9 +281,12 @@ main() {
             git tag "$NEW_VERSION" > /dev/null 2>&1
         fi
 
-        git_commit_and_push_no_tag
+        if ! build_release_binary; then
+            print_error "x86_64 release build failed; aborting release before push/upload"
+            exit 1
+        fi
 
-        build_release_binary || print_warning "x86_64 build failed"
+        git_commit_and_push_no_tag
 
         local binary_path_x86="build/nsigner_static_x86_64"
         local binary_path_arm64="build/nsigner_static_arm64"