Client-side verification is a check performed by the local application before it installs or runs downloaded code. Instead of trusting a repository name, tag, or marketplace label alone, the client confirms that the files on disk match the expected commit, version, or hash.
This matters because supply-chain attacks often target the gap between a trusted reference and the actual bytes delivered to the device. If the client fails to verify the final checkout, a pinned dependency, plugin, or extension can be replaced after review and still look legitimate to the user. Defenders use client-side verification to detect version drift, tampering, and re-signed or re-served content, and to enforce that the installed working tree matches the approved release. In practice, strong update systems combine pinning, hash checks, signature validation, and post-fetch verification to keep installed code aligned with what was audited.