install: verify release-artifact sha256 before installing - #22
Open
danieljohnmorris wants to merge 4 commits into
Open
install: verify release-artifact sha256 before installing#22danieljohnmorris wants to merge 4 commits into
danieljohnmorris wants to merge 4 commits into
Conversation
Pulls checksums-sha256.txt from the same GitHub release as the binary, greps out the expected hash, and refuses to install on mismatch or missing entry. Canonical source for the scripts now lives in the ilo repo at scripts/install/ — these are exact mirrors. See ilo-lang/ilo#548.
Mirrors the ergonomic improvement from ilo-lang/ilo#548. Users on locked-down systems can now point the installer at a writable directory of their choice; the CI regression test in the ilo repo uses the same hook.
Mirrors the SPEC + ai.txt additions from ilo-lang PR #557. Five new HTTP-verb builtins (PUT, PATCH, DELETE, HEAD, OPTIONS) with the same shape as pst/get, returning R t t and accepting optional headers maps. Verb cluster intentionally limited to the seven safe methods; TRACE and CONNECT stay out of scope.
Aligns the builtins/crypto reference with the actual builtin set landing on main: hex is now a single text→text builtin (lowercase hex encode of UTF-8 bytes), and standard base64 b64/b64-dec gets its own section alongside the URL-safe b64u/b64u-dec. Pre-shipped doc for the v1 PR (which exposed hex-enc/hex-dec as a bytes-list pair) is no longer accurate. The v2 scope is tighter and the hex builtin matches the rest of the cluster's text-in / text-out shape.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Companion to ilo-lang/ilo#548. The scripts served from
ilo-lang.ai/install.shand/install.ps1now downloadchecksums-sha256.txtfrom the same GitHub release, compare it against the SHA-256 of the binary they just fetched, and refuse to install on mismatch.Canonical source lives in the ilo repo under
scripts/install/. These public/ copies are exact mirrors so the curl-pipe one-liner on the homepage stays unchanged.Test plan
scripts/install/install.sh/install.ps1in the ilo repo (diff is empty)