mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-04 10:48:20 +00:00
Martin Vogel
c360440203
The ui-* archives are byte-identical copies of the canonical ones, published after verify so they inherit the hash-bound VirusTotal verdicts. They were absent from checksums.txt, and publish-legacy-aliases.sh documented that as intentional: "checksums.txt covers the canonical names current installers request." That reasoning has a hole. The aliases exist only for 0.9.x updaters (#1538), and those verify the NAME they asked for. So the alias fixed the 404 and moved the failure one step later - the updater downloads the archive, cannot find its name in checksums.txt, and refuses: warning: codebase-memory-mcp-ui-darwin-arm64.tar.gz not found in checksums.txt error: refusing to install an unverified download Reported by AmooAti in #1134. Confirmed on the live v0.10.4 release: eight ui-* archives published, zero of them listed. Every pre-0.10 user who answered the old variant chooser with "ui" is hard-blocked from updating by any path. The same digest is now emitted under the legacy name before the attestation step, so the attested artifact covers both names. No new bytes and no new scan surface: an alias is a copy, so its sha256 is by construction the one already computed. The rule lives in scripts/ci/append-legacy-alias-checksums.sh rather than inline in the workflow, because the venue-parity contract requires it: a venue may provision, plumb artifacts, or call a canonical leg script, and text transformation is none of those. Keeping it beside publish-legacy-aliases.sh also puts the two halves of the alias rule in one place, which matters because they must stay in step - .tar.gz and .zip only, never an already-ui-* name. It fails closed when it matches nothing, since a name with no asset is as broken as an asset with no name. Validated against the real v0.10.4 checksums file: the generated set is exactly the eight ui-* assets that release published - no phantom names, none missing - and the empty case exits non-zero. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
60 lines
2.4 KiB
Bash
Executable File
60 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Add the legacy ui-* names to checksums.txt, carrying the canonical digest.
|
|
#
|
|
# publish-legacy-aliases.sh publishes byte-identical ui-*-named copies of the
|
|
# release archives so already-released 0.9.x updaters stop 404ing (#1538). It
|
|
# runs after verify, so those copies inherit the hash-bound VirusTotal verdicts
|
|
# — and it therefore left them out of checksums.txt entirely, on the reasoning
|
|
# that the file "covers the canonical names current installers request".
|
|
#
|
|
# That reasoning has a hole. The aliases exist ONLY for 0.9.x updaters, and
|
|
# those verify the NAME they asked for. So the alias fixed the 404 and moved the
|
|
# failure one step later: the updater downloads the archive, cannot find its name
|
|
# in checksums.txt, and refuses to install it (#1134):
|
|
#
|
|
# warning: codebase-memory-mcp-ui-darwin-arm64.tar.gz not found in checksums.txt
|
|
# error: refusing to install an unverified download
|
|
#
|
|
# An alias is a copy, so its sha256 is by construction the digest already
|
|
# computed for the canonical archive. Emitting that digest under the legacy name
|
|
# introduces no new bytes and no new scan surface. This runs BEFORE the
|
|
# attestation step so the attested artifact covers both names.
|
|
#
|
|
# The alias rule MUST stay in step with publish-legacy-aliases.sh: .tar.gz and
|
|
# .zip only, never an already-ui-* name. A name here with no published asset is
|
|
# as broken as an asset with no name, so this fails closed when it matches
|
|
# nothing.
|
|
#
|
|
# Usage: append-legacy-alias-checksums.sh <checksums-file>
|
|
set -euo pipefail
|
|
|
|
CHECKSUMS="${1:?usage: append-legacy-alias-checksums.sh <checksums-file>}"
|
|
|
|
if [ ! -s "$CHECKSUMS" ]; then
|
|
echo "error: $CHECKSUMS is missing or empty" >&2
|
|
exit 1
|
|
fi
|
|
|
|
aliases="$(mktemp)"
|
|
trap 'rm -f "$aliases"' EXIT
|
|
|
|
awk '
|
|
$2 ~ /^codebase-memory-mcp-/ &&
|
|
$2 !~ /^codebase-memory-mcp-ui-/ &&
|
|
($2 ~ /\.tar\.gz$/ || $2 ~ /\.zip$/) {
|
|
alias = $2
|
|
sub(/^codebase-memory-mcp-/, "codebase-memory-mcp-ui-", alias)
|
|
print $1 " " alias
|
|
}
|
|
' "$CHECKSUMS" > "$aliases"
|
|
|
|
if [ ! -s "$aliases" ]; then
|
|
echo "error: no canonical archives matched the ui-* alias rule in $CHECKSUMS;" >&2
|
|
echo " publish-legacy-aliases.sh would then publish assets that" >&2
|
|
echo " checksums.txt does not cover (#1134)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
cat "$aliases" >> "$CHECKSUMS"
|
|
echo "added $(wc -l < "$aliases" | tr -d ' ') legacy alias checksum line(s); $CHECKSUMS now covers $(wc -l < "$CHECKSUMS" | tr -d ' ') names"
|