Repository navigation
Conversation
git-cliff releases publish a .sha512 next to each tarball. Check it before unpacking and fail on mismatch or when it is missing. Windows zips ship no checksum yet, so they are skipped with a warning. Closes orhun#87 Generated-by: Claude Opus 5
Replace the runtime .sha512 download with SHA-256 checksums of every git-cliff release archive pinned in checksums.sha256. An unpinned archive or a mismatch fails the step. Windows zips are covered too. Checksums come from GitHub's asset digests where recorded; older archives were downloaded and hashed, and cross-checked against the published .sha512 where one exists. The sync workflow appends the new release's digests when it bumps the version. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #87.
checksums.sha256pins the SHA-256 of every git-cliff release archive (Linux, macOS and Windows);install.shchecks the download against it before unpacking and fails on a mismatch or an unpinned archive. Nothing is fetched at verification time.versioninput.Where the checksums come from: GitHub's recorded asset digests for v2.9.0+; older archives were downloaded and hashed, and all 445 that ship a
.sha512matched it.One behaviour change:
version: latestfails in the window between a git-cliff release and the sync PR merging, since that version isn't pinned yet.Test plan: ran
install.shwith a stubbedcurlagainst the real v2.14.2 assets: pinned archive installs, tampered tarball fails with a mismatch error, unpinned version fails. TheAction Testworkflow covers the Linux path end to end.🤖 Generated with Claude Code