Add MIT LICENSE and make release checksums verifiable - #2
Merged
Conversation
The README has always declared MIT, but no LICENSE file backed it. The repo is now public and shipping binaries, so without one nobody has explicit rights to use them and package managers (Homebrew among them) will reject the project. The checksums file was also unusable as published: it was generated as `sha256sum dist/mcli-*`, so every line carried a `dist/` prefix that does not exist where users download the assets side by side. Worse, sha256sum exits 0 when it cannot find any of the listed files, so an install script that believed it was verifying checksums verified nothing at all. Generating it from inside dist/ records flat names, which verify where the files actually land — and fail, with a non-zero exit, when a binary does not match. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two loose ends from the v0.8.0 release.
MIT LICENSE. The README has declared MIT all along, but no
LICENSEfile backed it —gh repo viewreportedlicenseInfo: null. Now that the repo is public and shipping binaries, that gap means nobody has explicit rights to use them, and Homebrew (among other package managers) rejects projects without a detectable license. Copyright is attributed to monday.com Ltd.; say if it should read differently.Verifiable checksums.
checksums.txtwas generated assha256sum dist/mcli-* > dist/checksums.txt, so every line carried adist/prefix that doesn't exist where users download the assets. Verified against the real v0.8.0 release:The exit code is the real problem:
sha256sumreturns 0 when it can't find any of the listed files, so an install script that believed it was verifying checksums verified nothing. Generating from insidedist/records flat names. Simulated end to end with the new step:The hashes in v0.8.0 were correct — only the paths were wrong — so this changes no artifact, just makes the manifest usable. It takes effect on the next tag.
🤖 Generated with Claude Code