Repository navigation
Fix release checksums and install.sh without the GitHub API - #19
Merged
Merged
Conversation
Downloading v0.3.0 showed that checksums.txt, written by Set-Content on the Windows publish runner, uses CRLF: `sha256sum -c checksums.txt` reports every file as unreadable, although each hash matches once the CR is removed. v0.2.1 has the same file. Write the manifest with LF and fail the publish if a CR remains. install.sh ignores a trailing CR when it falls back to checksums.txt, so it also reads the files already published. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Installing the published v0.3.0 on a hosted Mac stopped at "could not read release latest from GitHub": the anonymous API limit is shared by every user behind one address. When the API request fails, resolve the latest tag from the release page redirect and verify the DMG against that release's checksums.txt. GitHub's asset digest is still preferred when the API answers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Record the release runs, the asset checksum comparison, the CRLF checksums file in v0.3.0 and v0.2.1, and install.sh against the published release on both Macs, including the fallback with the GitHub API blocked. The installation guides mention that fallback. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Findings from verifying the published v0.3.0:
sha256sum -c checksums.txtrejects every entry, although all hashes match once the CR is removed. The manifest is now written with LF and the publish fails if a CR remains.install.shignores a trailing CR when it readschecksums.txt, so it also handles the published files.checksums.txt; GitHub's asset digest is still preferred when the API answers.Validation against the published v0.3.0 (run 37334645617), both architectures: dry run and reinstall through the API, install with
api.github.comblocked (fallback, CRLF checksums), strict signature, no quarantine, LaunchServices launch and standard quit. The published v0.3.0 assets are not modified; the fix ships with the next release.🤖 Generated with Claude Code