chore: upgrade to llgo v0.11.6 and simplify CI setup #590
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,65 @@ | ||||||||||||||||||||
| #!/bin/bash | ||||||||||||||||||||
|
|
||||||||||||||||||||
| # Script to download and extract LLGo release | ||||||||||||||||||||
| # Usage: ./download-llgo.sh <version> <install_dir> | ||||||||||||||||||||
| # Example: ./download-llgo.sh v0.11.6 ./llgo | ||||||||||||||||||||
|
|
||||||||||||||||||||
| set -e | ||||||||||||||||||||
|
Contributor
There was a problem hiding this comment. For more robust error handling in shell scripts, it's a good practice to use
Suggested change
|
||||||||||||||||||||
|
|
||||||||||||||||||||
| VERSION=$1 | ||||||||||||||||||||
|
Contributor
There was a problem hiding this comment. Add input validation for VERSION parameter The VERSION parameter is interpolated into URLs without validation, creating potential for injection attacks if this script is used outside the controlled CI environment. Recommended: VERSION=$1
INSTALL_DIR=$2
if [ -z "$VERSION" ] || [ -z "$INSTALL_DIR" ]; then
echo "Usage: $0 <version> <install_dir>"
echo "Example: $0 v0.11.6 ./llgo"
exit 1
fi
# Validate VERSION format
if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9]+)?$ ]]; then
echo "Error: Invalid version format: $VERSION"
echo "Expected format: vX.Y.Z (e.g., v0.11.6)"
exit 1
fi |
||||||||||||||||||||
| INSTALL_DIR=$2 | ||||||||||||||||||||
|
|
||||||||||||||||||||
| if [ -z "$VERSION" ] || [ -z "$INSTALL_DIR" ]; then | ||||||||||||||||||||
| echo "Usage: $0 <version> <install_dir>" | ||||||||||||||||||||
| echo "Example: $0 v0.11.6 ./llgo" | ||||||||||||||||||||
| exit 1 | ||||||||||||||||||||
|
Comment on lines
+12
to
+15
Contributor
There was a problem hiding this comment. It's a best practice to print usage and error messages to standard error (stderr) instead of standard output (stdout). This allows users to redirect script output without capturing error messages.
Suggested change
|
||||||||||||||||||||
| fi | ||||||||||||||||||||
|
|
||||||||||||||||||||
| # Detect OS and architecture | ||||||||||||||||||||
| OS=$(uname -s | tr '[:upper:]' '[:lower:]') | ||||||||||||||||||||
| ARCH=$(uname -m) | ||||||||||||||||||||
|
|
||||||||||||||||||||
| # Map architecture names | ||||||||||||||||||||
| case $ARCH in | ||||||||||||||||||||
| x86_64) | ||||||||||||||||||||
| ARCH="amd64" | ||||||||||||||||||||
| ;; | ||||||||||||||||||||
| aarch64|arm64) | ||||||||||||||||||||
| ARCH="arm64" | ||||||||||||||||||||
| ;; | ||||||||||||||||||||
| *) | ||||||||||||||||||||
|
Comment on lines
+23
to
+30
Contributor
There was a problem hiding this comment. Add OS validation Consider validating the OS as well to provide clear error messages for unsupported platforms: # Map architecture names
case $ARCH in
x86_64)
ARCH="amd64"
;;
aarch64|arm64)
ARCH="arm64"
;;
*)
echo "Error: Unsupported architecture: $ARCH"
echo "Supported architectures: amd64, arm64"
echo "Detected: $(uname -m) on $(uname -s)"
exit 1
;;
esac
# Validate OS
case $OS in
darwin|linux)
# Supported
;;
*)
echo "Error: Unsupported operating system: $OS"
echo "Supported systems: darwin (macOS), linux"
exit 1
;;
esac |
||||||||||||||||||||
| echo "Unsupported architecture: $ARCH" | ||||||||||||||||||||
| exit 1 | ||||||||||||||||||||
| ;; | ||||||||||||||||||||
|
Comment on lines
+30
to
+33
Contributor
There was a problem hiding this comment. Error messages should be printed to standard error (stderr) to separate them from normal script output.
Suggested change
|
||||||||||||||||||||
| esac | ||||||||||||||||||||
|
|
||||||||||||||||||||
| # Construct download URL | ||||||||||||||||||||
| # Format: llgo{version}.{os}-{arch}.tar.gz | ||||||||||||||||||||
| # Example: llgo0.11.6.darwin-arm64.tar.gz or llgo0.11.6.linux-amd64.tar.gz | ||||||||||||||||||||
| # Remove 'v' prefix from version if present | ||||||||||||||||||||
| VERSION_NUMBER="${VERSION#v}" | ||||||||||||||||||||
| FILENAME="llgo${VERSION_NUMBER}.${OS}-${ARCH}.tar.gz" | ||||||||||||||||||||
| URL="https://github.com/goplus/llgo/releases/download/${VERSION}/${FILENAME}" | ||||||||||||||||||||
|
|
||||||||||||||||||||
| echo "Downloading LLGo ${VERSION} for ${OS}-${ARCH}..." | ||||||||||||||||||||
| echo "URL: $URL" | ||||||||||||||||||||
|
|
||||||||||||||||||||
| # Create install directory | ||||||||||||||||||||
| mkdir -p "$INSTALL_DIR" | ||||||||||||||||||||
|
|
||||||||||||||||||||
|
Contributor
There was a problem hiding this comment. CRITICAL: Missing checksum verification The script downloads and executes prebuilt binaries without any integrity verification. This is a significant supply chain security risk. Recommended fix: # Add -f flag to fail on HTTP errors, and add retry logic
curl -fL --retry 3 --retry-delay 2 --max-time 300 -o "/tmp/${FILENAME}" "$URL" || {
echo "Error: Failed to download LLGo from $URL"
exit 1
}
# Download and verify checksum (if available)
curl -fL -o "/tmp/${FILENAME}.sha256" "${URL}.sha256" 2>/dev/null && {
cd /tmp
sha256sum -c "${FILENAME}.sha256" || {
echo "Error: Checksum verification failed"
exit 1
}
}Security concerns:
See CWE-494: Download of Code Without Integrity Check
Comment on lines
+46
to
+49
Contributor
There was a problem hiding this comment. Use mktemp for secure temporary file handling Using predictable filenames in Recommended: # Create secure temporary file
TEMP_FILE=$(mktemp /tmp/llgo-download.XXXXXXXXXX)
trap "rm -f '$TEMP_FILE'" EXIT
mkdir -p "$INSTALL_DIR"
echo "Downloading LLGo ${VERSION} for ${OS}-${ARCH}..."
echo "URL: $URL"
curl -fL --retry 3 --retry-delay 2 --max-time 300 -o "$TEMP_FILE" "$URL"
tar -xzf "$TEMP_FILE" -C "$INSTALL_DIR" --strip-components=1This provides atomic temporary file creation and automatic cleanup. |
||||||||||||||||||||
| # Download and extract | ||||||||||||||||||||
| curl -L -o "/tmp/${FILENAME}" "$URL" | ||||||||||||||||||||
| tar -xzf "/tmp/${FILENAME}" -C "$INSTALL_DIR" | ||||||||||||||||||||
| rm "/tmp/${FILENAME}" | ||||||||||||||||||||
|
Comment on lines
+51
to
+53
Contributor
There was a problem hiding this comment. The download and extraction process can be simplified and made more robust.
This approach is cleaner and more idiomatic for shell scripting.
Suggested change
|
||||||||||||||||||||
|
|
||||||||||||||||||||
| echo "LLGo ${VERSION} has been installed to ${INSTALL_DIR}" | ||||||||||||||||||||
| echo "Binary location: ${INSTALL_DIR}/bin/llgo" | ||||||||||||||||||||
|
|
||||||||||||||||||||
|
Comment on lines
+56
to
+57
Contributor
There was a problem hiding this comment. Enhance post-installation validation The current check only verifies file existence. Consider adding: # Verify installation
if [ ! -f "${INSTALL_DIR}/bin/llgo" ]; then
echo "Error: llgo binary not found at ${INSTALL_DIR}/bin/llgo"
exit 1
fi
# Verify it's executable
if [ ! -x "${INSTALL_DIR}/bin/llgo" ]; then
echo "Error: llgo binary is not executable"
exit 1
fi
# Verify it's a valid binary
if ! file "${INSTALL_DIR}/bin/llgo" | grep -qE "(executable|ELF|Mach-O)"; then
echo "Error: llgo is not a valid binary executable"
exit 1
fi
echo "Installation verified successfully"
ls -lh "${INSTALL_DIR}/bin/llgo" |
||||||||||||||||||||
| # Verify installation | ||||||||||||||||||||
| if [ -f "${INSTALL_DIR}/bin/llgo" ]; then | ||||||||||||||||||||
| echo "Installation verified successfully" | ||||||||||||||||||||
| ls -lh "${INSTALL_DIR}/bin/llgo" | ||||||||||||||||||||
| else | ||||||||||||||||||||
| echo "Error: llgo binary not found at ${INSTALL_DIR}/bin/llgo" | ||||||||||||||||||||
| exit 1 | ||||||||||||||||||||
| fi | ||||||||||||||||||||
|
Comment on lines
+62
to
+65
Contributor
There was a problem hiding this comment. Error messages should be printed to standard error (stderr) to separate them from normal script output.
Suggested change
|
||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
exportcommand is not necessary here. A simple variable assignment is sufficient since$LLGO_ROOTis used in the next line within the samerunstep. Removingexportmakes the intent clearer that the variable is only used locally within this script block before being passed to the GitHub Actions environment.