Repository navigation
Conversation
The release-branch shell installer currently warns and replaces an existing binary when its checksum manifest is unavailable or no hash tool is installed. Require one valid SHA-256 entry, verify downloaded bytes in a destination-local temporary file, and leave the prior binary untouched on every failure path. Keep the three published script copies synchronized, preserve detected-client registration behind the new integration opt-out, and stop the installed hook from pointing at the removed codedb_edit tool for native sed/awk commands. Exercise checksum failures, valid install, hooks, and registration with isolated fixtures. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
The failure-path fixture opted out of integrations and exercised an extracted hook, so it did not prove the normal installation dispatch. Run a verified install inside a disposable HOME, assert detected-client registration preserves other servers, and invoke the hook file installed by main. Keep every failure scenario isolated from real client configuration. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
The existing failure fixtures opt out of integrations, which cannot prove that an invalid checksum stops before client configuration is touched. Run the mismatched-hash case with integrations enabled in a disposable HOME and assert its preexisting Claude registration remains byte-for-byte unchanged. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
The verifier matched the selected asset in the second field but ignored trailing fields, so a malformed manifest line with a correct hash could authorize replacement. Require exactly two fields on each selected-asset entry and count malformed duplicates as conflicts. Exercise the trailing-field case through the installer's main path with integrations enabled; failure must leave the prior binary and client configuration unchanged. Co-Authored-By: Codegraff <blackfloofie@codegraff.com>
Owner
Author
|
Status: exact-head 2ba90d4 passed bench and macos-resource-regression; the installer suite passed 17/17 and MCP E2E passed 76/76. The unchanged semantic retry unit test fails on a clean release-base worktree and is disclosed in the PR body. An attempt to mark this PR ready was blocked by Codegraff publication preflight (128 KiB committed-source / 256 KiB review-packet limit) despite a 23,790-byte final patch. This second case is recorded in justrach/codegraff#1304. I am leaving the PR draft rather than bypassing the gate; no new release or tag has been created. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The macOS/Linux installer now requires exactly one valid SHA-256 entry for the selected release asset and a working hash tool before it replaces an existing binary. It downloads to a destination-local temporary file, verifies there, and removes the temporary file on failure. The checked-in website installer copies remain byte-identical. A
CODEDB_NO_INTEGRATIONSguard keeps integration registration out of isolated installs while preserving the release branch's detected-client registration for normal installs. The installed hook no longer blocks nativesed/awkedits with advice to use the removedcodedb_edittool.Why
On the current
release/0.2.5856branch, an unavailable checksum manifest or missing hash tool produces a warning but still installs unverified bytes over the prior binary. That is a fail-open supply-chain path. Requiring a unique valid manifest entry and verifying before the move preserves the existing installation on download, manifest, hash, or verification failure. The trade-off is intentional: installation now stops during a manifest outage rather than falling back to an unverified binary. Keeping the temporary file in the destination directory also avoids a cross-filesystem replacement. The oldsed/awkhook advice cannot work because CodeDB no longer offers an edit tool.This is isolated from draft PR #750's retrieval/transport changes and draft PR #758's watcher changes. It does not alter hosted Jina, default hybrid retrieval, or the 4× ANN candidate pool.
Verification — exact head
2ba90d4518906c4c26c5b819a3f4e43a96b84c02The latest commit rejects selected-asset checksum lines with trailing fields. It changes installer scripts and the test fixture only; Zig sources and the compiled binary are unchanged.
python3.12 scripts/test_installer_safety.py— 17/17 cases passed at this head: nine isolated failure/opt-out installs (including mismatch and trailing-field manifests with integrations enabled and existing config unchanged), one successful normalmaininstall, three Claude/Codex/detected-Qwen registrations preserving other servers, and four commands run through the hook actually installed bymain. All fixtures use disposable HOME directories.bash -n install/install.sh website/app/install_script.sh website/dist/install.shpassed; the three scripts are byte-identical.zig build -Doptimize=ReleaseFastpassed before this shell-only parser edit (arm64 candidate SHA-256d240207f1df64df192b0bb556b4e56b18c79c3be6a36a1211ecee9549788fe60); no Zig source changed.python3 scripts/e2e_mcp_test.py --binary .graff/verify/codedb-installer-branch --project "$PWD"— 76/76 passed.zig build test --summary all— fails in the unchanged semantic retry test (EmbeddingTimeout): 1,620 passed, 13 skipped, one failed. This reproduces on a cleanrelease/0.2.5856worktree at565238036b7a2e29dc13972a45f5d59910d3fbfdwithzig build test-semantic --summary all(27/28 passed, same timeout); a separately filtered run also failed 0/1 on that timeout. No Zig files change in this PR. Do not treat this as a green unit suite.2ba90d4passedbench(5m14s) andmacos-resource-regression(2m59s); the guard job was skipped. The prior head07a44bdalso passed both jobs. The clean-base semantic-suite failure above remains disclosed rather than counted as a pass.Merging this PR only updates the release branch; it does not create a new tag, signed/notarized artifact, or deployment. The published
v0.2.5856tag remains unchanged. Release publication also remains gated by the separate hosted-Jina rejection.