From 166c1e9c24eb33c2ee8161479a814db95ca8cc51 Mon Sep 17 00:00:00 2001
From: Wanjohi <elviswanjohi47@gmail.com>
Date: Wed, 2 Sep 2026 13:23:13 +0300
Subject: [PATCH] fix(nesdoctor): pin the release tag; `releases/latest` is a
 time bomb here

Both installers fetched from `releases/latest/download`, which is wrong in this
repository specifically: it ships product releases as well as this tool, so
`latest` is whichever release went out most recently regardless of what it
contains.

Measured before publishing anything: `releases/latest` resolved to `v0.2.0`,
from May 2024, and the asset URL 404'd. Publishing nesdoctor-v0.1.0 would have
papered over it by becoming the newest release -- and then the first product
release after it would have moved `latest` again and broken every
`curl | sh` in the announcement, silently, for everyone, with the tool itself
untouched and nothing to point at.

Now pinned to a tag that is bumped when a nesdoctor release is cut, with
`NESDOCTOR_TAG` still overriding for testing. The download failure message also
now names the tag and says outright that an unpublished tag is the likely
cause, since that is the one mistake this arrangement invites.
---
 apps/nesdoctor/README.md           |  4 ++++
 apps/nesdoctor/install/install.ps1 | 16 ++++++++++------
 apps/nesdoctor/install/install.sh  | 18 +++++++++++-------
 3 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/apps/nesdoctor/README.md b/apps/nesdoctor/README.md
index d9d714b9..7a256391 100644
--- a/apps/nesdoctor/README.md
+++ b/apps/nesdoctor/README.md
@@ -16,6 +16,10 @@ install nothing, need no administrator rights, and touch no system directory.
 worker fetches them from this repository, so you can read exactly what you are
 about to run before you run it.
 
+They pin a release tag rather than using `releases/latest`, because this
+repository ships product releases too and `latest` is whichever went out most
+recently. `NESDOCTOR_TAG` overrides it.
+
 Or build it yourself:
 
 ```
diff --git a/apps/nesdoctor/install/install.ps1 b/apps/nesdoctor/install/install.ps1
index c650cb7a..a34a116d 100644
--- a/apps/nesdoctor/install/install.ps1
+++ b/apps/nesdoctor/install/install.ps1
@@ -17,7 +17,15 @@ $ErrorActionPreference = 'Stop'
 Set-StrictMode -Version Latest
 
 $Repo = 'nestrilabs/nestri'
-$Tag  = $env:NESDOCTOR_TAG
+
+# Pinned, and NOT `releases/latest`. This repository ships product releases as
+# well as this tool, so `latest` is whatever went out most recently -- it
+# resolved to a 2024 release while this was being written, and the day a
+# product release goes out it would move again and every install here would
+# 404. Bump this line when cutting a nesdoctor release; NESDOCTOR_TAG overrides
+# it for testing.
+$DefaultTag = 'nesdoctor-v0.1.0'
+$Tag = if ($env:NESDOCTOR_TAG) { $env:NESDOCTOR_TAG } else { $DefaultTag }
 
 # TLS 1.2 explicitly: Windows PowerShell 5.1 still defaults to older protocols
 # on some builds, and GitHub refuses them, which surfaces as a bare
@@ -31,11 +39,7 @@ if ($arch -ne 'x86_64') {
 $target = 'x86_64-pc-windows-msvc'
 $asset  = "nesdoctor-$target.exe"
 
-$base = if ($Tag) {
-  "https://github.com/$Repo/releases/download/$Tag"
-} else {
-  "https://github.com/$Repo/releases/latest/download"
-}
+$base = "https://github.com/$Repo/releases/download/$Tag"
 
 $tmp = Join-Path ([IO.Path]::GetTempPath()) ("nesdoctor-" + [Guid]::NewGuid().ToString('N'))
 New-Item -ItemType Directory -Path $tmp | Out-Null
diff --git a/apps/nesdoctor/install/install.sh b/apps/nesdoctor/install/install.sh
index 160c0e81..4cb5b153 100755
--- a/apps/nesdoctor/install/install.sh
+++ b/apps/nesdoctor/install/install.sh
@@ -16,7 +16,15 @@
 set -eu
 
 REPO="nestrilabs/nestri"
-TAG="${NESDOCTOR_TAG:-}"          # empty means latest
+
+# Pinned, and NOT `releases/latest`. This repository ships product releases as
+# well as this tool, so `latest` is whatever went out most recently -- it
+# resolved to a 2024 release while this was being written, and the day a
+# product release goes out it would move again and every install here would
+# 404. Bump this line when cutting a nesdoctor release; `NESDOCTOR_TAG`
+# overrides it for testing.
+DEFAULT_TAG="nesdoctor-v0.1.0"
+TAG="${NESDOCTOR_TAG:-$DEFAULT_TAG}"
 TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT INT TERM
 
@@ -60,14 +68,10 @@ else
   die "need curl or wget"
 fi
 
-if [ -n "$TAG" ]; then
-  BASE="https://github.com/$REPO/releases/download/$TAG"
-else
-  BASE="https://github.com/$REPO/releases/latest/download"
-fi
+BASE="https://github.com/$REPO/releases/download/$TAG"
 
 say "Downloading nesdoctor ($target)…"
-get "$BASE/$ASSET" "$TMP/$ASSET" || die "download failed. Is there a release yet? $BASE/$ASSET"
+get "$BASE/$ASSET" "$TMP/$ASSET" || die "download failed: $BASE/$ASSET\n  If $TAG is not published yet, that is why."
 
 # --- verify -----------------------------------------------------------------
 # A checksum we fetch from the same place as the binary is not a security