fix(landing): stop promising a SHA-256 in Windows install-help modal#46
Draft
Relevant47 wants to merge 1 commit into
Draft
fix(landing): stop promising a SHA-256 in Windows install-help modal#46Relevant47 wants to merge 1 commit into
Relevant47 wants to merge 1 commit into
Conversation
The Windows reassurance text promised users "you can verify the file hash below before running it", but the hash never appears: the `#ih-hash` section is gated on a `sha256` value from `/api/download` that the endpoint doesn't return (and the release pipeline doesn't publish `.sha256` sidecars to compute one from). Telling a suspicious user "verify the file hash below" and then showing nothing is a broken trust signal exactly when reassurance is needed. Replace the promise with a claim that's actually true today: the source is on GitHub and can be read or built locally. The `#ih-hash` markup and JS branch stay in place so that if the API ever returns `sha256` (issue #44 Option A), the hash UI lights up automatically. Fixes #44
✅ Deploy Preview for focuslock-app ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Windows install-help reassurance text promised users they could "verify the file hash below before running it", but the
#ih-hashsection never showed because/api/download.jsnever returns asha256field and the release pipeline doesn't publish.sha256sidecars to compute one from. Replace the promise with a claim that's true today (source is on GitHub; can be read or built locally). The#ih-hashmarkup and JS branch are left in place so this PR is forward-compatible with a future Option A that ships hashes.Files changed
landing/index.html— single string change toSTEPS.win.reassure(line 2936).Fixes #44
Risk tier
Ambiguous direction — the issue offers two fixes and either one is defensible, so this is a DRAFT with
needs-review. (Please apply theneeds-reviewlabel — the bot's tooling in this environment can't create labels.) This is a one-line landing-page string change, so the change itself is low-risk — the review is about which option to take, not the diff.Option chosen (B — remove the claim)
#ih-hashDOM and theopenInstallHelp('win', data.sha256)call paths intact, so swapping back to Option A later requires zero re-edit on the landing side — just start returningsha256from/api/download.js.Option NOT taken (A — actually ship the hash)
The issue's Option A snippet looks for
<asset>.sha256sidecar files on the GitHub release. I checked.github/workflows/release.yml— the release pipeline does not produce.sha256sidecars today (the onlysha256reference is signtool's timestamp digest). So Option A as written would always findnulland the modal would still show nothing.A real Option A would require, in order:
release.ymlthat runssha256sum FocusLock-Setup.exe > FocusLock-Setup.exe.sha256(and the macOS equivalent) and uploads each sidecar to the GitHub release.api/download.jsto fetch the matching.sha256asset, parse the hex, and include it in the JSON response.If you'd rather take Option A, this PR can be discarded and the work redone on the release/API side — no edits to the landing page would be needed there because the JS branch already wires
data.sha256through to the hash UI.What a reviewer should verify
#ih-hashblock atlanding/index.html:2418-2420stays in the DOM; only the prose changed.sha256/SHA-256/hashand the remaining matches are the friend-lock copy at lines 1912 and 2167, which is a separate, accurate cryptographic claim.)🤖 Generated with Claude Code
Generated by Claude Code