docs: make the release install concrete, and say that a verdict is stated - #8
Conversation
…ated
The "from a release" section described a download rather than showing one:
no URL, no checksum command, no way to follow it without guessing at the
asset naming. There was no release to point at when it was written; v0.1.0
is published now, so it can be copy-pasteable.
The block is verified rather than composed: run verbatim in a bare
debian:bookworm-slim container with neither Go nor git, it resolves
linux_arm64, verifies against the published SHA256SUMS, and prints
"jig v0.1.0". The macOS shasum form is checked too.
Checksum-before-run is called out deliberately. This is a binary an
operator is about to hand their repositories to.
Also record what the verdict gate now enforces: under verdict_consistent
`approved` must be stated as a JSON boolean, and omitting it is its own
failure rather than a silent rejection. That is load-bearing for anyone
writing a review phase, because `on_fail: {when: "approved == false"}` is
how a review routes work back to a builder, and a verdict nobody gave must
not decide it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe README now documents verified installation from a versioned release archive. It also defines the required ChangesREADME updates
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Line 52: Update the macOS checksum command in the README to explicitly pass
SHA256SUMS as the checksum record file to shasum, while preserving the existing
sha256sum command and its ignore-missing behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| curl -fsSLO "$BASE/jig_${VERSION}_${OS}_${ARCH}.tar.gz" | ||
| curl -fsSLO "$BASE/SHA256SUMS" | ||
|
|
||
| sha256sum -c SHA256SUMS --ignore-missing # macOS: shasum -a 256 -c |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- README.md context ---'
sed -n '40,60p' README.md
printf '%s\n' '--- release script references ---'
rg -n -C 3 'SHA256SUMS|sha256|shasum|tar\.gz|VERSION|OS|ARCH' scripts/release.sh README.mdRepository: StructuPath/jig
Length of output: 3936
🏁 Script executed:
#!/bin/bash
set -eu
archive='jig_v0.1.0_darwin_arm64.tar.gz'
digest=$(printf 'sample archive contents\n' | shasum -a 256 | awk '{print $1}')
record="$digest ./$archive"
printf '%s\n' '--- available checksum tools ---'
command -v shasum || true
command -v sha256sum || true
printf '%s\n' '--- generated checksum record ---'
printf '%s\n' "$record"
printf '%s\n' '--- selected macOS-style verification ---'
printf '%s\n' "$record" | grep -F "$archive" | shasum -a 256 -c -
printf '%s\n' '--- checksum input behavior without a filename ---'
set +e
printf '%s\n' "$record" | timeout 2 shasum -a 256 -c
status=$?
set -e
printf 'status=%s\n' "$status"Repository: StructuPath/jig
Length of output: 401
🌐 Web query:
Perl shasum documentation -c checksum file standard input "-" macOS
💡 Result:
On macOS, the shasum command is a Perl-based utility used to compute and verify SHA checksums [1][2]. To read from standard input (stdin) instead of a file, you can either omit the file argument or explicitly use a hyphen (-) [3][4][5]. Standard usage for reading from stdin: - Compute hash of data: echo "data" | shasum -a 256 [1][6][5] - Read checksums for verification from stdin: echo "HASH FILENAME" | shasum -a 256 -c - [7][8] Key implementation details for macOS: - Algorithm Selection: The default algorithm is SHA-1 [3][1]. To use secure versions like SHA-256, you must specify it using the -a flag (e.g., shasum -a 256) [1][6][7]. - Checksum Verification: When using the -c option to verify, the expected input format is a line containing the checksum, two spaces, and the filename (e.g., ) [1][7][9]. - Portability: Because macOS includes shasum by default, it is often preferred over GNU-specific tools like sha256sum for cross-platform shell scripts that need to run on both macOS and Linux [1]. Important Note: When using commands like echo to pipe data into shasum, be aware that echo may add a trailing newline character by default, which changes the resulting hash [2]. Use echo -n if you intend to hash the string without a trailing newline [2].
Citations:
- 1: https://shellmap.eversources.app/cmd/shasum
- 2: https://superuser.com/questions/1180155/why-do-i-get-different-results-from-macs-shasum-than-from-other-shasum-calculat
- 3: https://keith.github.io/xcode-man-pages/shasum.1.html
- 4: https://perldoc.perl.org/shasum
- 5: https://docs.oracle.com/cd/E88353_01/html/E37839/shasum-1.html
- 6: https://blog.nodejslab.com/how-to-hash-files-in-macos-terminal/
- 7: https://techearl.com/verify-checksum-mac-command-line
- 8: https://apple.stackexchange.com/questions/388965/how-do-i-verify-the-checksum-or-hash-of-a-downloaded-file-on-the-command-line
- 9: https://stackoverflow.com/questions/70502738/sha256sum-standard-input-no-properly-formatted-checksum-lines-found
Make the macOS checksum command read SHA256SUMS.
shasum -a 256 -c reads checksum records from standard input. It does not read the downloaded SHA256SUMS file and can wait for terminal input. Select the requested archive explicitly:
Proposed fix
-sha256sum -c SHA256SUMS --ignore-missing # macOS: shasum -a 256 -c
+# Linux:
+sha256sum -c SHA256SUMS --ignore-missing
+# macOS:
+grep -F "jig_${VERSION}_${OS}_${ARCH}.tar.gz" SHA256SUMS |
+ shasum -a 256 -c -📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| sha256sum -c SHA256SUMS --ignore-missing # macOS: shasum -a 256 -c | |
| # Linux: | |
| sha256sum -c SHA256SUMS --ignore-missing | |
| # macOS: | |
| grep -F "jig_${VERSION}_${OS}_${ARCH}.tar.gz" SHA256SUMS | | |
| shasum -a 256 -c - |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 52, Update the macOS checksum command in the README to
explicitly pass SHA256SUMS as the checksum record file to shasum, while
preserving the existing sha256sum command and its ignore-missing behavior.
1 participant
Two README updates, both prompted by things that became true this week:
v0.1.0is published and the repo is public.The release install is now runnable
It previously described a download rather than showing one — no URL, no checksum command, no way to follow it without guessing the asset naming. Reasonable when there was no release to point at; not now.
The replacement is verified, not composed. Run verbatim in a bare
debian:bookworm-slimcontainer with neither Go nor git installed:The macOS
shasum -a 256 -c --ignore-missingform is checked separately on a Mac, since it is a different tool with different flag support and I did not want to document a command I had not run.Checksum-before-run is called out on purpose. This is a binary the reader is about to trust with their repositories, and "verify it against SHA256SUMS" as a passing clause is easy to skip.
A verdict is stated, never inferred
Records what
verdict_consistentnow enforces after #5:approvedmust be written as a JSON boolean, and omitting it is its own gate failure rather than a silent rejection.This is load-bearing for anyone writing a review phase.
on_fail: {when: "approved == false"}is how a review routes work back to a builder, so a verdict nobody stated must not decide that in either direction — which is exactly the failure #5 fixed, where an omitted field was reported asapproved=falseand the cheapest repair was to flip it totrue.Verification
internal/engine/gates.go— still accurate, unchanged.just checkgreen.🤖 Generated with Claude Code
Summary by CodeRabbit
approvedfield for verdict consistency checks.