Verify codecov bash script before execution

Justfile

@@ -16,7 +16,18 @@ coverage:
     rm -f *.profraw
 
 # upload coverage to https://codecov.io
-upload-coverage:
+upload-coverage: get-codecov
     @# {{env_var("CODECOV_TOKEN")}}
     just coverage
-    bash -c "bash <(curl -s https://codecov.io/bash) -f lcov.info"
+    bash -c "./codecov -f lcov.info"
+
+get-codecov:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    curl -s https://codecov.io/bash > codecov;
+    VERSION=$(grep -o 'VERSION=\"[0-9\.]*\"' codecov | cut -d'"' -f2);
+    for i in 1 256 512
+    do
+        shasum -a $i -c --ignore-missing <(curl -s "https://raw.githubusercontent.com/codecov/codecov-bash/${VERSION}/SHA${i}SUM") ||
+        shasum -a $i -c <(curl -s "https://raw.githubusercontent.com/codecov/codecov-bash/${VERSION}/SHA${i}SUM")
+    done