feat(install): install from install.socket.dev, optionally without github.com

[Mikola Lysenko (mikolalysenko)]

Points the documented one-liner at a Socket-controlled domain, and lets the archives come
from Socket too:

curl -fsSL https://install.socket.dev/patch | sh

The old URL was raw.githubusercontent.com — a third-party CDN serving a script users pipe
into a shell, and the first URL a locked-down egress policy blocks.

Companion PR: SocketDev/depscan#23840, which serves the host. Nothing here breaks before
that lands: the drift workflow and the Socket-origin CI step are both inert until the
host resolves, and the README's alternative URL works today.

What the host serves

A byte-for-byte copy of scripts/install.sh, with its SHA-256 at /patch.sha256. The
README tells people to diff it, so that has to hold literally. The GitHub raw URL keeps
working and serves the same bytes.

Installing without reaching github.com

New SOCKET_PATCH_BASE_URL points the archive downloads at any releases base answering
GitHub's two asset paths:

curl -fsSL https://install.socket.dev/patch \
  | SOCKET_PATCH_BASE_URL=https://install.socket.dev/patch/SocketDev/socket-patch/releases sh

install.socket.dev relays exactly those paths from the GitHub release, which is why one
template covers both origins and the script needs no branching.

A new release needs no publish for this. The origin resolves "latest" per request
against the upstream release, so cutting 3.4.0 makes it installable from Socket's host
immediately — nothing runs at release time.

socket-patch --update can use the same host today with no CLI changes, via the
SOCKET_UPDATE_BASE_URL override it already has. One caveat documented rather than papered
over: a non-default value intentionally downgrades the downloaded binary's version
self-check from hard-fail to a warning, because that knob targets mirrors that may
repackage. Making Socket's host a first-class endpoint set that keeps the strict check is a
CLI change, not a hosting one — deliberately not here.

Also adds SOCKET_PATCH_INSTALL_DIR, which wins over both existing defaults: what
unprivileged installs into a toolchain-managed prefix need, and what makes the script
testable without writing to a system path.

Trust model: unchanged, and the docs say so

Binaries still come from the GitHub release and are still verified against its
SHA256SUMS. Nothing is signed. Whichever origin serves the bytes, the checksums come from
that same origin. Hosting moved who serves the script, nothing more.

The default origin is still GitHub, on purpose

Flipping it is one line, held until the relay is verified in prod. A script defaulting to a
host that does not answer yet is a broken installer for everyone running it from a git
checkout or the raw URL — and CI's end-to-end install step would fail on main
immediately. Sequence: this merges → depscan#23840 deploys → flip the default.

Four gaps closed around a curl | sh artifact

1. install.sh was only shellchecked, never run. CI now installs with it end to end
   and execs the result — twice, once with the default origin and once through
   SOCKET_PATCH_BASE_URL, so the URL template is covered too.
2. A third step installs through install.socket.dev and asserts the installed version
   matches what that host reports as latest. Skips itself with a notice until the host
   resolves.
3. Nothing kept the URL consistent across the README, the script's usage comment, and
   the runbook; a grep guard fails if any drifts.
4. Nothing checked the hosted copy. New installer-drift workflow (weekly + dispatch)
   diffs the served bytes against scripts/install.sh, verifies the published checksum, and
   shellchecks what is served. Not part of CI — it tests a deployed artifact, so a red run
   means "bump the submodule pin in depscan", not "this PR is broken". It also names the
   specific failure this design is exposed to: a Cloudflare bot challenge, which would
   otherwise feed an HTML interstitial to sh.

docs/installer-hosting.md is the runbook for the non-obvious part: the hosted copy is
published from depscan's vendored submodule pin, so an installer change here goes live on a
submodule bump plus a deploy.

Verified

CI green on the pre-squash commits — all six Shell steps in lint-ecosystems passed,
including both end-to-end installs, and the Socket-origin step correctly emitted
install.socket.dev/patch/latest does not answer yet — skipping. Locally, against the real
relay: latest and pinned installs both succeeded and were checksum-verified, and
socket-patch --update worked through the same host (--dry-run resolved latest;
--update 3.2.0 downloaded and swapped).

The only failing check is hosted-e2e / gem_bundler_hosted_redirect_and_known_install_defect
— the known gem/Bundler marshal data too short defect against rubygems.org, unrelated to
this change.

Sequencing note

depscan's submodule pin is 19 commits behind main, and scripts/install.sh does
differ (main has the SC2144 detect_libc fix). So: merge this → bump the pin → deploy.
installer-drift is red in that window by design, and its error message says which bump is
missing.

Not in scope

• Flipping the default origin (one-line follow-up after prod verification).
• patch.ps1 for native Windows — the hosting side already supports it; left out rather
  than shipped untested from a macOS box.

[John-David Dalton (jdalton)]

Three things, all inline. The big one: pointing SOCKET_PATCH_BASE_URL at the host adds Socket's stack to the trust set rather than dropping GitHub, and SHA256SUMS rides the same origin as the archive. docs/installer-hosting.md says the trust model is unchanged, which holds for the default only.

One not inline, since the file is not in the diff: SOCKET_UPDATE_BASE_URL drops the https-only redirect rule in update/release.rs too.