github-mirrors/netris-nestri
1
0
Fork 0
mirror of https://github.com/nestriness/nestri.git synced 2026-09-19 17:25:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(nesdoctor): pin the release tag; releases/latest is a time bomb here

Browse Source 
Both installers fetched from `releases/latest/download`, which is wrong in this
repository specifically: it ships product releases as well as this tool, so
`latest` is whichever release went out most recently regardless of what it
contains.

Measured before publishing anything: `releases/latest` resolved to `v0.2.0`,
from May 2024, and the asset URL 404'd. Publishing nesdoctor-v0.1.0 would have
papered over it by becoming the newest release -- and then the first product
release after it would have moved `latest` again and broken every
`curl | sh` in the announcement, silently, for everyone, with the tool itself
untouched and nothing to point at.

Now pinned to a tag that is bumped when a nesdoctor release is cut, with
`NESDOCTOR_TAG` still overriding for testing. The download failure message also
now names the tag and says outright that an unpublished tag is the likely
cause, since that is the one mistake this arrangement invites.
This commit is contained in:
Wanjohi
2026-09-02 13:23:13 +03:00
parent 09b9472134
commit 166c1e9c24
3 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/nesdoctor/README.md
View File

@@ -16,6 +16,10 @@ install nothing, need no administrator rights, and touch no system directory.
worker fetches them from this repository, so you can read exactly what you are
about to run before you run it.
They pin a release tag rather than using `releases/latest`, because this
repository ships product releases too and `latest` is whichever went out most
recently. `NESDOCTOR_TAG` overrides it.
Or build it yourself:
```

16
apps/nesdoctor/install/install.ps1
View File

@@ -17,7 +17,15 @@ $ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest
$Repo = 'nestrilabs/nestri'
$Tag = $env:NESDOCTOR_TAG
# Pinned, and NOT `releases/latest`. This repository ships product releases as
# well as this tool, so `latest` is whatever went out most recently -- it
# resolved to a 2024 release while this was being written, and the day a
# product release goes out it would move again and every install here would
# 404. Bump this line when cutting a nesdoctor release; NESDOCTOR_TAG overrides
# it for testing.
$DefaultTag = 'nesdoctor-v0.1.0'
$Tag = if ($env:NESDOCTOR_TAG) { $env:NESDOCTOR_TAG } else { $DefaultTag }
# TLS 1.2 explicitly: Windows PowerShell 5.1 still defaults to older protocols
# on some builds, and GitHub refuses them, which surfaces as a bare
@@ -31,11 +39,7 @@ if ($arch -ne 'x86_64') {
$target = 'x86_64-pc-windows-msvc'
$asset = "nesdoctor-$target.exe"
$base = if ($Tag) {
"https://github.com/$Repo/releases/download/$Tag"
} else {
"https://github.com/$Repo/releases/latest/download"
}
$base = "https://github.com/$Repo/releases/download/$Tag"
$tmp = Join-Path ([IO.Path]::GetTempPath()) ("nesdoctor-" + [Guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $tmp | Out-Null

16
apps/nesdoctor/install/install.sh
View File

@@ -16,7 +16,15 @@
set -eu
REPO="nestrilabs/nestri"
TAG="${NESDOCTOR_TAG:-}" # empty means latest
# Pinned, and NOT `releases/latest`. This repository ships product releases as
# well as this tool, so `latest` is whatever went out most recently -- it
# resolved to a 2024 release while this was being written, and the day a
# product release goes out it would move again and every install here would
# 404. Bump this line when cutting a nesdoctor release; `NESDOCTOR_TAG`
# overrides it for testing.
DEFAULT_TAG="nesdoctor-v0.1.0"
TAG="${NESDOCTOR_TAG:-$DEFAULT_TAG}"
TMP="$(mktemp -d)"
trap 'rm -rf "$TMP"' EXIT INT TERM
@@ -60,14 +68,10 @@ else
die "need curl or wget"
fi
if [ -n "$TAG" ]; then
BASE="https://github.com/$REPO/releases/download/$TAG"
else
BASE="https://github.com/$REPO/releases/latest/download"
fi
say "Downloading nesdoctor ($target)…"
get "$BASE/$ASSET" "$TMP/$ASSET" || die "download failed. Is there a release yet? $BASE/$ASSET"
get "$BASE/$ASSET" "$TMP/$ASSET" || die "download failed: $BASE/$ASSET\n If $TAG is not published yet, that is why."
# --- verify -----------------------------------------------------------------
# A checksum we fetch from the same place as the binary is not a security