Summary
File: docs/getting_started/troubleshooting.md:97-104
The "roll back to 0.62.0" instructions added in the 0.62.1 troubleshooting section fetch the release zip over HTTPS but don't verify the SHA256:
```powershell
Remove-Module Thycotic.SecretServer -Force -ErrorAction SilentlyContinue
Invoke-WebRequest -Uri 'https://github.com/thycotic-ps/thycotic.secretserver/releases/download/v0.62.0/Thycotic.SecretServer.zip' -OutFile '.\Thycotic.SecretServer-0.62.0.zip'
Expand-Archive -Path '.\Thycotic.SecretServer-0.62.0.zip' -DestinationPath '.\Thycotic.SecretServer-0.62.0' -Force
Import-Module '.\Thycotic.SecretServer-0.62.0\Thycotic.SecretServer\Thycotic.SecretServer.psd1' -Force
```
GitHub HTTPS gives transport-level integrity, but the project publishes an SHA256 alongside every release zip specifically so users can independently verify the download. The install.md page teaches this pattern; the rollback snippet should mirror it.
Proposed fix
Add a Get-FileHash verification step referencing the published SHA256 for the v0.62.0 asset (fetched from the release page's sha256sums.txt or equivalent). Cross-link to the install.md integrity-verification section.
Snippet shape:
```powershell
Invoke-WebRequest -Uri 'https://github.com/thycotic-ps/thycotic.secretserver/releases/download/v0.62.0/Thycotic.SecretServer.zip' -OutFile '.\Thycotic.SecretServer-0.62.0.zip'
$expected = ''
$actual = (Get-FileHash -Path '.\Thycotic.SecretServer-0.62.0.zip' -Algorithm SHA256).Hash
if ($actual -ne $expected) { throw "SHA256 mismatch. Expected $expected, got $actual" }
Expand-Archive ...
Import-Module ...
```
Discovery
Consolidated PR review of v0.62.0 → dev (0.62.1 candidate).
Summary
File:
docs/getting_started/troubleshooting.md:97-104The "roll back to 0.62.0" instructions added in the 0.62.1 troubleshooting section fetch the release zip over HTTPS but don't verify the SHA256:
```powershell
Remove-Module Thycotic.SecretServer -Force -ErrorAction SilentlyContinue
Invoke-WebRequest -Uri 'https://github.com/thycotic-ps/thycotic.secretserver/releases/download/v0.62.0/Thycotic.SecretServer.zip' -OutFile '.\Thycotic.SecretServer-0.62.0.zip'
Expand-Archive -Path '.\Thycotic.SecretServer-0.62.0.zip' -DestinationPath '.\Thycotic.SecretServer-0.62.0' -Force
Import-Module '.\Thycotic.SecretServer-0.62.0\Thycotic.SecretServer\Thycotic.SecretServer.psd1' -Force
```
GitHub HTTPS gives transport-level integrity, but the project publishes an SHA256 alongside every release zip specifically so users can independently verify the download. The
install.mdpage teaches this pattern; the rollback snippet should mirror it.Proposed fix
Add a
Get-FileHashverification step referencing the publishedSHA256for the v0.62.0 asset (fetched from the release page'ssha256sums.txtor equivalent). Cross-link to theinstall.mdintegrity-verification section.Snippet shape:
```powershell
Invoke-WebRequest -Uri 'https://github.com/thycotic-ps/thycotic.secretserver/releases/download/v0.62.0/Thycotic.SecretServer.zip' -OutFile '.\Thycotic.SecretServer-0.62.0.zip'
$expected = ''
$actual = (Get-FileHash -Path '.\Thycotic.SecretServer-0.62.0.zip' -Algorithm SHA256).Hash
if ($actual -ne $expected) { throw "SHA256 mismatch. Expected $expected, got $actual" }
Expand-Archive ...
Import-Module ...
```
Discovery
Consolidated PR review of v0.62.0 → dev (0.62.1 candidate).