mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-08 08:53:43 +08:00
Martin VogelandAndrew Hundt
70b2994425
The previous commit pinned the linux/amd64 asset hash directly, which verified the asset this job needs but hard-coded the platform: the uname-based selection was replaced by a fixed filename, so moving the job to another runner OS or architecture would have needed a code change and a second pinned hash. Pin the SHA-256 of the release's own checksums file instead, and verify whichever asset the runner selects against it. Upstream publishes that file for the whole release, covering linux, darwin and windows on both amd64 and arm64, so one pinned value now covers every platform and the uname-based selection is restored. Match the asset by exact filename, since a substring match would also accept the .sbom.json and .sigstore.json lines for the same asset, and fail closed when an asset is absent from the checksums file rather than installing it unverified. Verified end to end against the pinned release: the checksums file matches its pinned hash; asset selection resolves to a listed asset for linux/amd64, linux/arm64, darwin/amd64 and darwin/arm64; the linux/amd64 asset verifies and extracts to a statically linked x86-64 ELF; and appending one byte to the downloaded asset makes verification FAIL, so the gate binds rather than passing vacuously. Co-Authored-By: Andrew Hundt <ATHundt@gmail.com> Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>