Skip to content

Releases: basis-network/basis-cli

Release list

v0.1.0

v0.1.0 Latest
Latest

Choose a tag to compare

View all tags
@sebastian-quintero-osorio sebastian-quintero-osorio released this 24 Aug 03:26
v0.1.0
a6dff69

First tagged release of the Basis CLI.

The binaries are not new — they are the ones running against the devnet — but until now they had no version number, only the date they were copied.

Install

git clone https://github.com/basis-network/basis-cli.git
cd basis-cli
./download.sh                    # linux-x86_64
./download.sh windows-x86_64

The script downloads the binary and verifies it against the checksum committed in this repository. It refuses to continue if it cannot verify.

Verify by hand

curl -fSLO https://github.com/basis-network/basis-cli/releases/download/v0.1.0/basis-linux-x86_64
mv basis-linux-x86_64 basis
sha256sum -c checksums/v0.1.0/linux-x86_64.sha256
Asset SHA-256
basis-linux-x86_64 508e09cabf6cea5542e4a12b6bb93a763f7f38d53c75c2ef82da92386b0e4c82
basis-windows-x86_64.exe 707d3ad22b675227dff0ab13c6babd18c972a687a1959b854acbbb96ea06db18

Signatures

Both assets are signed with Sigstore cosign in keyless mode by the release workflow, which first verified each one against the checksums committed in this repository. There is no private signing key: the identity is the workflow's OIDC token and the certificate is in the public Rekor transparency log.

cosign verify-blob basis-linux-x86_64 \
  --bundle basis-linux-x86_64.cosign.bundle \
  --certificate-identity-regexp \
    'https://github.com/basis-network/basis-cli/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

(The annotated git tag for this release says it is unsigned. That was written minutes before the workflow ran and proved otherwise. The tag is left where it is: a published tag that moves under people is a worse problem than a stale sentence in its message.)

The checksums are in git, not in this release. That is deliberate: a checksum stored beside the file it describes proves nothing, because whoever can replace one can replace the other.

basis-node is not distributed here

Earlier checksum files covered basis-node as well as basis. They no longer do. This is a deliberate narrowing of what the repository vouches for: Basis is permissioned, there is no third-party node operation to support, and shipping a node binary publicly promised something that was never on offer.

Known rough edges

Documented in full in the README, because each one costs an afternoon to find:

  • Queries want the last 20 bytes of a 32-byte account. The first 20 answer balance 0 instead of failing.
  • Printed units are wrong. The unit is the tomo; 1 LITHOS = 10⁹ tomos, not 10¹⁸.
  • No HTTP headers. There is no way to send Authorization: Bearer.
  • Embedded TLS roots. Corporate TLS inspection breaks every HTTPS call, and SSL_CERT_FILE has no effect.
  • No macOS build.

The network is a development network. LITHOS has no value and the chain may be reset without notice.

Assets 6
Loading