fix(installer): two R8 curl|bash install P0s — stamper guard-clobber + provision --name (hotfix → main → v1.8.2)#288
Closed
saadqbal wants to merge 1 commit into
Closed
fix(installer): two R8 curl|bash install P0s — stamper guard-clobber + provision --name (hotfix → main → v1.8.2)#288saadqbal wants to merge 1 commit into
saadqbal wants to merge 1 commit into
Conversation
…ives (v1.8.1 regression) The sign-installer-manifest job replaced __TRACEBLOC_RELEASE_REF__ GLOBALLY when stamping the published install.sh. install.sh's fail-closed guard (`if [[ "$REF" == "__TRACEBLOC_RELEASE_REF__" ]]`) references the SAME token to detect an un-stamped build, so the global replace rewrote it to the release tag too — turning the guard into `== "v1.8.1"`, which then fired on the exact success case. Every install from the v1.8.1 signed installer errored "This installer wasn't stamped with a pinned release tag" (backend#830); curl|bash of tracebloc.io/i.sh (→ releases/latest/download/install.sh) was broken for everyone. - Anchor the awk stamp to `/^DEFAULT_REF=/` — only the assignment line is rewritten; the guard keeps its placeholder sentinel and works. - Post-stamp: assert DEFAULT_REF was stamped to the tag AND the guard sentinel is still present (regression guard for the clobber). - Self-test: add the missing POSITIVE path — run the stamped installer and assert it clears the guard (never prints "wasn't stamped"). The old self-test only checked bad-ref rejection, which passed despite the bug. Verified locally: the surgically-stamped install.sh clears the guard and proceeds to the fetch. - chart: bump 1.8.1 -> 1.8.2 for the re-release (version + appVersion lockstep). install.sh source is unchanged — the fix is entirely in the stamper. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
saadqbal
added
the
skip-fr-gate
Contributor
Author
|
Redirecting through develop first. The buggy stamper lives on develop too (came in via #281 → #284), so a main-only hotfix gets reintroduced by the very next develop→main sync — which this PR itself only flagged as a follow-up. Moved the fix to #289 (→ develop); main then follows via the develop→main promotion + the v1.8.2 tag. Closing this one. |
saadqbal
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
main-landing of the two P0s that broke the R8
curl | bashinstall end to end (develop-side: #289). On merge I cut v1.8.2.1. Stamper clobbered install.sh's fail-closed guard
sign-installer-manifestreplaced__TRACEBLOC_RELEASE_REF__globally, rewriting the guard (== "__TRACEBLOC_RELEASE_REF__"→== "v1.8.1") — so the stamped installer errored "wasn't stamped" on every run. Fix: stamp only/^DEFAULT_REF=/; assert DEFAULT_REF stamped and the guard sentinel survives; self-test now runs the stamped installer to confirm it clears the guard.2. Provisioning never passed
--nameprovision.sh runs
tracebloc client createwith output redirected to the log, so the CLI can't prompt and requires--name— every browser-auth install failed at Step 3 ("--name is required — no TTY to prompt"). Fix: provision.sh supplies name (+ location) viaTRACEBLOC_CLIENT_NAME/_LOCATIONenv →/dev/ttyprompt → fail closed.Verified locally
Ran the surgically-stamped installer (clears the guard, proceeds to fetch); provision.bats 12/12; shellcheck clean. Chart 1.8.1 → 1.8.2.
Same content as #289 (→ develop). FR gate bypassed via
skip-fr-gate. After merge I'll cut v1.8.2 and — this time — verify by actually runningcurl | bashthrough provisioning end to end.🤖 Generated with Claude Code