How to securely host downloadable source code

Question

As a follow up to The most secure way to allow downloading and installing an app on Mac, Windows, or Linux, I am wondering how one (such as I) may go about creating a new framework for hosting packages in a secure way. Ignoring the question of whether or not you should reinvent the wheel, I am mainly wondering for a learning exercise. In addition, I am wondering how sites like docker, homebrew, etc. might provide a more secure and robust way to download their app. Currently, homebrew is this:

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Docker is a download from the website

VMWare Fusion is straight from the website too. VSCode is too. That is, none of these apps (I can't think of any apps I use actually) are from the Mac App Store. Sublime. Atom (Atom is at least on GitHub). etc..

If I wanted to simply provide a shell script to install the program, how could I go about securing it properly?

Say the shell script downloads another few shell scripts, which then download either an .exe, .app, or .iso depending on the platform however. What steps should be put in place to make this secure. That is, not using any third party package manager or publishing solutions, doing it all yourself. I'm guessing I'd do it similar to how the Linux Y project does it (referenced in the answer to the question at the top).

1. Create an MD5 hash of the source code.
2. Publish this MD5 hash somehow in some guaranteed secure way (I don't see how you can prevent hackers who have compromised your site, from compromising this MD5 hash).
3. Let the user curl <path> the script, then less <script> to see the contents, etc. Then to somehow fetch the MD5 hash from some remote server I have to compare it. How does Linux Y project do this?
4. Perhaps submit some final statistics to let us know the download completed safely as expected, I don't know.

Wondering if one could quickly/briefly outline the steps I would need to take to host such a download/install script so that it was optimally secure, without using any third party tools. That will help me get a deeper understanding of how this all works.

Basically I'm wondering how these third party package manager solution thingy's are considered secure. What exactly did they do that I could do too?

As a sidenote, I would like to provide two ways to download. Either the shell script curl method, or the download the package directly. But in either case I want to let them know that they should still inspect everything in case of tampering. But I don't know what that inspection process really looks like, and so am a ways off from understanding how to construct a system for aiding in security/protection too.

Answer 1

As it was said in the answer to your other question (that you linked yourself), "Check sums (and cryptographically secure hashes) only ensures integrity", but naturally only to the extend you can trust them. If somebody compromises the server your program and the check sums/hashes are stored on they can modify both, and the integrity is then limited to "this program hasn't been modified since this hash was generated". But you do have some protection against problems on the network (working as a man-in-the-middle it's a little harder to modify the program and the hash so they still match).

If you want to do a little better you make sure the hashes are available elsewhere, you can create a repository for your program on github (I don't know their terms, and thus not whether this would be violating them, making this bad advice) putting them in a file there.

Even better you could cryptographically sign the program, publish the signature and tell people to verify that what they are about to install is signed by you.