fix(nesdoctor): pin the release tag; releases/latest is a time bomb here

Both installers fetched from `releases/latest/download`, which is wrong in this
repository specifically: it ships product releases as well as this tool, so
`latest` is whichever release went out most recently regardless of what it
contains.

Measured before publishing anything: `releases/latest` resolved to `v0.2.0`,
from May 2024, and the asset URL 404'd. Publishing nesdoctor-v0.1.0 would have
papered over it by becoming the newest release -- and then the first product
release after it would have moved `latest` again and broken every
`curl | sh` in the announcement, silently, for everyone, with the tool itself
untouched and nothing to point at.

Now pinned to a tag that is bumped when a nesdoctor release is cut, with
`NESDOCTOR_TAG` still overriding for testing. The download failure message also
now names the tag and says outright that an unpublished tag is the likely
cause, since that is the one mistake this arrangement invites.

apps/nesdoctor/README.md

@@ -16,6 +16,10 @@ install nothing, need no administrator rights, and touch no system directory.
 worker fetches them from this repository, so you can read exactly what you are
 about to run before you run it.
 
+They pin a release tag rather than using `releases/latest`, because this
+repository ships product releases too and `latest` is whichever went out most
+recently. `NESDOCTOR_TAG` overrides it.
+
 Or build it yourself:
 
 ```

apps/nesdoctor/install/install.ps1

@@ -17,7 +17,15 @@ $ErrorActionPreference = 'Stop'
 Set-StrictMode -Version Latest
 
 $Repo = 'nestrilabs/nestri'
-$Tag  = $env:NESDOCTOR_TAG
+
+# Pinned, and NOT `releases/latest`. This repository ships product releases as
+# well as this tool, so `latest` is whatever went out most recently -- it
+# resolved to a 2024 release while this was being written, and the day a
+# product release goes out it would move again and every install here would
+# 404. Bump this line when cutting a nesdoctor release; NESDOCTOR_TAG overrides
+# it for testing.
+$DefaultTag = 'nesdoctor-v0.1.0'
+$Tag = if ($env:NESDOCTOR_TAG) { $env:NESDOCTOR_TAG } else { $DefaultTag }
 
 # TLS 1.2 explicitly: Windows PowerShell 5.1 still defaults to older protocols
 # on some builds, and GitHub refuses them, which surfaces as a bare
@@ -31,11 +39,7 @@ if ($arch -ne 'x86_64') {
 $target = 'x86_64-pc-windows-msvc'
 $asset  = "nesdoctor-$target.exe"
 
-$base = if ($Tag) {
+$base = "https://github.com/$Repo/releases/download/$Tag"
-  "https://github.com/$Repo/releases/download/$Tag"
-} else {
-  "https://github.com/$Repo/releases/latest/download"
-}
 
 $tmp = Join-Path ([IO.Path]::GetTempPath()) ("nesdoctor-" + [Guid]::NewGuid().ToString('N'))
 New-Item -ItemType Directory -Path $tmp | Out-Null

apps/nesdoctor/install/install.sh

@@ -16,7 +16,15 @@
 set -eu
 
 REPO="nestrilabs/nestri"
-TAG="${NESDOCTOR_TAG:-}"          # empty means latest
+
+# Pinned, and NOT `releases/latest`. This repository ships product releases as
+# well as this tool, so `latest` is whatever went out most recently -- it
+# resolved to a 2024 release while this was being written, and the day a
+# product release goes out it would move again and every install here would
+# 404. Bump this line when cutting a nesdoctor release; `NESDOCTOR_TAG`
+# overrides it for testing.
+DEFAULT_TAG="nesdoctor-v0.1.0"
+TAG="${NESDOCTOR_TAG:-$DEFAULT_TAG}"
 TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT INT TERM
 
@@ -60,14 +68,10 @@ else
   die "need curl or wget"
 fi
 
-if [ -n "$TAG" ]; then
 BASE="https://github.com/$REPO/releases/download/$TAG"
-else
-  BASE="https://github.com/$REPO/releases/latest/download"
-fi
 
 say "Downloading nesdoctor ($target)…"
-get "$BASE/$ASSET" "$TMP/$ASSET" || die "download failed. Is there a release yet? $BASE/$ASSET"
+get "$BASE/$ASSET" "$TMP/$ASSET" || die "download failed: $BASE/$ASSET\n  If $TAG is not published yet, that is why."
 
 # --- verify -----------------------------------------------------------------
 # A checksum we fetch from the same place as the binary is not a security