mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-25 06:33:13 +08:00
Martin Vogel
5821078ee5
Seven packaging surfaces declared 0.8.1 while v0.10.8 was the shipped release — nine releases of drift in metadata published to package registries, and the third version-metadata drift this month. pkg/go was not cosmetic: it hardcodes its version into the release URL it downloads from, so `go install` fetched v0.8.1 binaries. Chocolatey had to move as a unit. The nuspec is version-only but chocolateyInstall.ps1 pins the asset sha256, so bumping the nuspec alone would ship a package declaring 0.10.8 while installing 0.8.1. The new checksum is the v0.10.8 windows-amd64.zip digest, verified by downloading the published asset and hashing it, not merely copied from checksums.txt. The gate (tests/test_version_metadata_contract.sh, scripts/test.sh Step 0x) checks against the newest stable v-prefixed tag, because nothing in the tree declares the version: CBM_VERSION is injected at build time and the release is dispatched with a version input. That absence is exactly why these files drifted. Mutual consistency across the surfaces needs no git and always runs, so a shallow clone degrades the gate loudly instead of passing silently. Homebrew (0.10.3), Scoop and AUR (0.8.1) are left pinned: each embeds per-release asset checksums, so bumping them is a distribution chore rather than a metadata edit. They are still gated — internally consistent, and never naming a release that does not exist — and each carries a recorded reason for being frozen. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>