Harden remote plugin installs

command/init.go

@@ -85,6 +85,7 @@ for more info.`)
 			Checksummers: []plugingetter.Checksummer{
 				{Type: "sha256", Hash: sha256.New()},
 			},
+			ReleasesOnly: true,
 		},
 	}
 
@@ -127,7 +128,20 @@ for more info.`)
 			}
 
 			if cla.Force && !cla.Upgrade {
-				pluginRequirement.VersionConstraints, _ = gversion.NewConstraint(fmt.Sprintf("=%s", installs[len(installs)-1].Version))
+				// Only place another constaint to the latest release
+				// binary, if any, otherwise this is essentially the same
+				// as an upgrade
+				var installVersion string
+				for _, install := range installs {
+					ver, _ := gversion.NewVersion(install.Version)
+					if ver.Prerelease() == "" {
+						installVersion = install.Version
+					}
+				}
+
+				if installVersion != "" {
+					pluginRequirement.VersionConstraints, _ = gversion.NewConstraint(fmt.Sprintf("=%s", installVersion))
+				}
 			}
 		}
 

command/plugins_install.go

@@ -130,6 +130,7 @@ func (c *PluginsInstallCommand) RunContext(buildCtx context.Context, args *Plugi
 			Checksummers: []plugingetter.Checksummer{
 				{Type: "sha256", Hash: sha256.New()},
 			},
+			ReleasesOnly: true,
 		},
 	}
 	if runtime.GOOS == "windows" {