docs: document pinned installs and what v0.6.0 signs - #15
Conversation
The install instructions did not need a version bump: they run the installers, which resolve `latest` through the releases API. Verified rather than assumed -- that endpoint returns v0.6.0 now, so the commands already in the README install it. What was missing is the other half. Both installers accept a specific version, and neither README nor docs/releases.md said so, which left pinning -- the thing anything unattended should do -- discoverable only by reading the scripts. Also records where signing begins. v0.6.0 is the first signed release, so REQUIRE_SIGNATURE against an earlier tag fails rather than passing quietly; that is correct, and worth knowing before pinning an old version in automation. v0.6.0 also carries SLSA build provenance over every archive, which docs/releases.md documents and the README did not mention at all. Both documented commands were run end to end against the real release: `VERSION=v0.6.0` on the shell installer downloads linux/amd64, verifies the checksum and installs; `-Version v0.6.0` on the PowerShell installer installs a binary reporting 0.6.0 (80daf48). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e167e5c1ad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Install a specific release rather than whatever is newest: | ||
|
|
||
| ```bash | ||
| curl -fsSL https://raw.githubusercontent.com/packetloss404/packetcode/main/install.sh | VERSION=v0.6.0 bash |
There was a problem hiding this comment.
Both new pinned-install examples still download the installer from the mutable main branch. If that script later changes incompatibly, is removed, or is compromised, rerunning the documented v0.6.0 command can behave differently or fail even though VERSION pins the archive, contradicting the reproducible/unattended-install guidance below. Fetch the installer from the matching v0.6.0 tag (or an immutable commit) as well.
Useful? React with 👍 / 👎.
1 participant
The install commands did not need a version bump
They invoke the installers, which resolve
latestthrough the releases API. Verified rather than assumed:So the commands already in the README install v0.6.0 today. Changing them to hardcode a version would have made them worse.
What was actually missing
Pinning. Both installers accept a specific version —
VERSION=and-Version— and neither the README nordocs/releases.mdsaid so. That left the thing anything unattended should do discoverable only by reading the scripts.Where signing begins. v0.6.0 is the first signed release.
REQUIRE_SIGNATURE=1against an earlier tag fails rather than passing quietly (install.shline 112) — correct behaviour, and worth knowing before pinning an old version in automation.Provenance. v0.6.0 carries a SLSA build-provenance attestation over every archive.
docs/releases.mddocuments it; the README did not mention it at all.Verified end to end against the real release
... | VERSION=v0.6.0 bashDownloading packetcode v0.6.0 for linux/amd64, checksum verified, installed... -Version v0.6.0packetcode 0.6.0 (80daf48…)Both run into scratch directories, not onto
PATH.No other version references were stale: the Go line already reads 1.26.0 (matching
go.mod), and there is no version badge.🤖 Generated with Claude Code