Conversation
…rs (#68) Homebrew/install has no tags, so its installer is pinned to a commit of main; the mise installer is pinned to release v2026.9.1 (it embeds the checksums of that release's binaries). Both are downloaded to a mktemp -d dir, sha256-checked against a hash recorded next to the ref at the top of the script, and only then run. On apt and dnf, mise comes from its signed extrepo / COPR repos first, with the pinned installer as the fallback. fisher is fetched with curl -fsSL and pinned to tag 4.4.8. README documents how to bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bootstrap.shand thepluginstask piped three remote installers — Homebrew's, mise's and fisher's — straight into a shell, unpinned and unverified, so a fresh machine ran whatever those URLs happened to serve that day as its first act, before anything in this repo existed to check it. fisher's usedcurl -sLwithout-f, so an error page would have been sourced into fish as a script.The two pins could not be done the same way. Homebrew's installer repo has no tags and no releases, so a commit is the only thing to pin to. mise's has to come from a release asset rather than
mise.run, because that script embeds the checksums of its own release's binaries — settingMISE_VERSIONon it instead makes it fetch checksums over the network at install time, which is the property being removed here.I have not run any of the three installers, so the first real bootstrap is also the first end-to-end test of the pins. What would show up there and not here is a URL that stops serving the pinned bytes, which
fetch_verifiedrejects rather than installs.Closes #68