Repository navigation
build(cli): harden install.sh with checksum verification; validate release pipeline - #21
Merged
Merged
Conversation
…lease pipeline The GoReleaser path had never actually executed, and install.sh had no release to fetch — so the documented one-line install was broken for anyone who tried it. Validated locally before tagging anything: - goreleaser check passes; `release --snapshot` produces all 6 archives (linux/darwin/windows x amd64/arm64) plus checksums.txt - every cross-compile target builds and the version ldflag genuinely injects (binary reports the version, not just "it compiled") - the archive contains the binary at the path install.sh expects, and extracting + running it works install.sh hardening — anything piped into a shell deserves scrutiny: - VERIFIES the SHA-256 against the published checksums.txt before installing, with sha256sum/shasum fallback and an explicit warning when neither exists. A curl|sh installer that skips this trusts the transport alone. - fails closed on a checksum mismatch, on a missing binary in the archive, and on a failed download (previously a 404 body could be extracted as if it were an archive) - AGENTDRAFT_VERSION to pin a tag, AGENTDRAFT_INSTALL_DIR to relocate - requires curl/tar up front, traps INT/TERM as well as EXIT for tmpdir cleanup Verified by running the real installer against a local fake release: happy path installs and the binary runs; a deliberately corrupted archive is REJECTED with "checksum MISMATCH"; a pinned version resolves. shellcheck and `sh -n` clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The GoReleaser path had never actually executed, and
install.shhad no release to fetch — so the documented one-line install was broken for anyone who tried it.Validated locally before tagging anything
goreleaser checkpasses;release --snapshotproduces all 6 archives (linux/darwin/windows x amd64/arm64) +checksums.txtinstall.shexpects, and extracting + running it worksinstall.sh hardening
Anything piped into a shell deserves scrutiny:
checksums.txtbefore installing, withsha256sum/shasumfallback and an explicit warning when neither exists. Acurl | shinstaller that skips this trusts the transport alone.AGENTDRAFT_VERSIONto pin a tag,AGENTDRAFT_INSTALL_DIRto relocateHow tested
Ran the real installer against a local fake release:
checksum MISMATCHAGENTDRAFT_VERSIONshellcheckandsh -nclean.