Skip to content

v5.11.65

Latest
Latest

Choose a tag to compare

View all tags
@alexgreensh alexgreensh released this 25 Jul 08:56
v5.11.65
5c0af3b

The installer was broken. It isn't now.

Every release from v5.11.57 through v5.11.64 shipped with no CHECKSUMS.sha256 asset attached. install.sh verifies every install against that asset, and verification is the default path — so resolve_latest_release() found nothing, and every new-user install aborted. The only way through was TOKEN_OPTIMIZER_SKIP_VERIFY=1, which meant the documented path to installing this tool was to first switch off its integrity checking.

Nothing caught it for eleven releases, because everything that looks inward was green: tests passing, docs building, and existing users unaffected (/plugin installs from the marketplace clone and never crosses that gate). The break was only visible from where a new user stands.

Fixed

  • CHECKSUMS.sha256 regenerated and attached for v5.11.64 and this release. The manifest had been frozen at v5.11.53 because scripts/sign-release.sh was manual-only and simply stopped being run.
  • Releases now sign themselves. A new Sign release workflow regenerates and uploads the manifest on every published release, then verifies its own upload from the outside. A release step that lives in a human's memory is not a step.
  • CI now fails when the published release cannot be installed. A new installable job asks the outward question against the live releases API on every push and PR. It is deliberately allowed to fail a push that did not cause it: a broken published install path is more urgent than the change in flight.

Hardening found while testing the guards

  • The signing self-verify could pass on an empty manifest — sha256sum -c on a zero-line file exits 0. Now guarded.
  • A manifest with CRLF line endings was certified installable, then would fail inside a user's install as "may be compromised". Now rejected with a message naming the real fix.
  • The guard's red paths now assert it withholds its success marker when it fails, verified by mutation testing.
  • The CI probe retries transient network failures, so an unrelated PR never goes red for a reason its author cannot fix.

No functional changes to Token Optimizer itself. This release is entirely about being installable and being able to prove it.

Assets 3
Loading