Add release download script - #123
Conversation
Automating release retrieval avoids requiring users to manually resolve the latest tag and select a package architecture.
There was a problem hiding this comment.
Reviewed the new packaging/download-latest.sh release helper against this repo's conventions (error handling, command execution safety, and consistency with the existing manual instructions in README.md). go build/go vet/go test ./... -race -cover all pass on this branch (unaffected by this change). One correctness issue inline.
|
SonarCloud flagged two |
Enforce HTTPS-only redirects in download-latest.sh SonarCloud flagged both curl/wget calls in the new release-download script (rule shell:S6506): a redirect could silently downgrade the transfer to plain HTTP, allowing a MITM to serve a tampered release. - The GitHub API request now runs through a shared curl invocation with --proto '=https' --proto-redir '=https', which rejects both an insecure initial URL and an insecure redirect target. - The release-archive download switches from wget to the same curl invocation, since wget (tested against a local redirecting server) has no equivalent way to reject an HTTP redirect target for a non-recursive download; --https-only only restricts recursive link following, not redirects. This also drops wget from the script's required-commands check.
|
1 participant
Pull Request
📖 Description
Automating release retrieval avoids requiring users to manually resolve the latest tag and select a package architecture.
🎫 Issues
N/A
👩💻 Reviewer Notes
None
📑 Test Plan
✅ Checklist
General
go test ./... -race -coverpasses locally).go vet ./...andgolangci-lint runare clean.ARCHITECTURE.mdif this changes a documented design decision.REST API / configuration / packaging
docs/API.mdto reflect a REST API change./api/v1/...response shapes, or a new API version(
/api/v2/...) was introduced instead.README.md/packaging/pimonitor.example.yamlto reflect a new orchanged configuration option.
packaging/install.shor the systemd units if this changesinstallation/packaging, and kept the unprivileged/privileged service split intact
(see
SECURITY.md).⏭ Next Steps
None