From 3d9024d616f326a363674d9218ac153020c1a2e8 Mon Sep 17 00:00:00 2001 From: Bartosz Blizniak Date: Thu, 30 Jul 2026 11:34:09 +0100 Subject: [PATCH] fix: verify Cloudsmith downloads at the raw versions path The published files are served at raw/versions//, not the raw/names path the verify step used, so a green publish failed on a 404. The download is also captured to a file first, so a failed download now hits the skip notice instead of hashing an empty stream and reporting a spurious checksum mismatch. Documents the served URLs in the README and folds the shipped publish job into the 0.1.0 changelog section. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 7 ++++--- CHANGELOG.md | 15 +++++++++------ README.md | 8 ++++---- 3 files changed, 17 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2ff263e..5c06565 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -293,12 +293,13 @@ jobs: set -eu VERSION="${TAG#v}" for file in cli.sh cli.ps1 SHA256SUMS; do - url="https://dl.cloudsmith.io/public/$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO/raw/names/$file/versions/$VERSION/$file" - expected="$(sha256sum "$file" | awk '{print $1}')" - if ! actual="$(curl -fsSL "$url" | sha256sum | awk '{print $1}')"; then + url="https://dl.cloudsmith.io/public/$CLOUDSMITH_NAMESPACE/$CLOUDSMITH_REPO/raw/versions/$VERSION/$file" + if ! curl -fsSL "$url" -o "verify-$file"; then echo "notice: could not download $url (repository may still be private); skipping verification" continue fi + expected="$(sha256sum "$file" | awk '{print $1}')" + actual="$(sha256sum "verify-$file" | awk '{print $1}')" if [ "$expected" != "$actual" ]; then echo "checksum mismatch for $url" >&2 exit 1 diff --git a/CHANGELOG.md b/CHANGELOG.md index f132895..38b9020 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,18 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Fixed + +- The release workflow verifies the published Cloudsmith files at their + actual download path (`raw/versions//`), and a failed + download is reported as a notice instead of a spurious checksum mismatch. + +## [0.1.0] - 2026-07-30 + ### Added - Release workflow job publishing the install scripts to Cloudsmith as `cli.sh` and `cli.ps1` (with `SHA256SUMS`), gated on configuration and authenticated via the CLI's GitHub Actions OIDC exchange. Served at - `https://install.cloudsmith.com/raw/files/cli.`. + `https://install.cloudsmith.com/raw/versions/latest/cli.`. - README instructions for installing from the published Cloudsmith URLs. - -## [0.1.0] - 2026-07-16 - -### Added - - Cross-platform `install.sh` and `install.ps1` installers for the standalone Cloudsmith CLI. - Automatic platform detection, including native Arm64 selection under diff --git a/README.md b/README.md index fc037a2..d07c327 100644 --- a/README.md +++ b/README.md @@ -64,11 +64,11 @@ Tagged releases are also published to Cloudsmith as `cli.sh` and `cli.ps1`, served at stable short URLs. Install the latest CLI with one command: ```sh -curl -fsSL https://install.cloudsmith.com/raw/files/cli.sh | sh +curl -fsSL https://install.cloudsmith.com/raw/versions/latest/cli.sh | sh ``` ```powershell -irm https://install.cloudsmith.com/raw/files/cli.ps1 | iex +irm https://install.cloudsmith.com/raw/versions/latest/cli.ps1 | iex ``` Both scripts install the latest CLI version by default and print the @@ -76,8 +76,8 @@ installed `bin_dir` to add to `PATH`. To verify before running, or to pin a version, download the script and `SHA256SUMS` from -`https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names//versions//` -where `` is `cli.sh`, `cli.ps1`, or `SHA256SUMS`, then run it with +`https://install.cloudsmith.com/raw/versions//` +where `` is `cli.sh`, `cli.ps1`, or `SHA256SUMS`, then run it with `--version X.Y.Z` (`-Version X.Y.Z` in PowerShell). Use pinned, verified downloads in CI.