Skip to content

Commit 57afc58

Browse files
DicklesworthstoneDicklesworthstone
committed
fix(update): fetch fresh checksums via GitHub API
1 parent 0a971e0 commit 57afc58

3 files changed

Lines changed: 166 additions & 23 deletions

File tree

‎scripts/generated/internal_checksums.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
declare -gA ACFS_INTERNAL_CHECKSUMS=(
1111
[scripts/lib/security.sh]="1fc1cb591fd62ac56d12c5af183de9674e501a74d478b3dd60901167262e919a"
1212
[scripts/lib/agents.sh]="0d4e7666b7a7267203445c364ad2d4997775826175700627abe83c70afce2269"
13-
[scripts/lib/update.sh]="63cfcdb36b6ea89e31ec269ed1f6d3782c7156a7a57de637bb7f28927c027da2"
13+
[scripts/lib/update.sh]="8a43e4fcfef29df3eadb0c69a091a66670d0834cc3b7e8691835f6acd5e418a5"
1414
[scripts/lib/doctor.sh]="89cbdcf2c6b5a88404857a8885508f686c9aeba04e69a95b4e99475ba9148f42"
1515
[scripts/lib/doctor_fix.sh]="0010bcf607fce4cb5447a7f5daee0bdf507b03839f97be746a0afdab97e1b249"
1616
[scripts/lib/autofix.sh]="ae7cc5e0b3af3f170d647945d3daee9a341c9276c270fe06895ab9aaf26ba805"

‎scripts/lib/update.sh‎

Lines changed: 33 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2774,7 +2774,6 @@ sync_acfs_global_wrapper() {
27742774
# Checksums Refresh (Auto-update from GitHub)
27752775
# ============================================================
27762776

2777-
CHECKSUMS_URL="https://raw.githubusercontent.com/${ACFS_REPO_OWNER}/${ACFS_REPO_NAME}/${ACFS_CHECKSUMS_REF}/checksums.yaml"
27782777
CHECKSUMS_LOCAL="${ACFS_HOME:-$HOME/.acfs}/checksums.yaml"
27792778

27802779
update_resolve_checksums_file() {
@@ -2878,6 +2877,10 @@ update_sync_known_installer_urls_from_checksums() {
28782877
refresh_checksums() {
28792878
local quiet="${1:-false}"
28802879
local checksums_local=""
2880+
local checksums_ref="${ACFS_CHECKSUMS_REF:-main}"
2881+
local api_url="https://api.github.com/repos/${ACFS_REPO_OWNER}/${ACFS_REPO_NAME}/contents/checksums.yaml?ref=${checksums_ref}"
2882+
local raw_url="https://raw.githubusercontent.com/${ACFS_REPO_OWNER}/${ACFS_REPO_NAME}/${checksums_ref}/checksums.yaml?cb=$(date +%s)"
2883+
local fetched_source=""
28812884

28822885
checksums_local="$(update_runtime_acfs_home 2>/dev/null || true)"
28832886
if [[ -z "$checksums_local" ]]; then
@@ -2898,32 +2901,42 @@ refresh_checksums() {
28982901
return 1
28992902
fi
29002903

2901-
if update_curl --connect-timeout 5 --max-time 30 -o "$tmp_checksums" "$CHECKSUMS_URL" 2>/dev/null; then
2902-
# Validate it looks like a checksums file
2903-
if grep -q "^installers:" "$tmp_checksums" 2>/dev/null; then
2904-
if mv "$tmp_checksums" "$checksums_local" 2>/dev/null; then
2905-
chmod 644 "$checksums_local" 2>/dev/null || true # Ensure readable permissions
2906-
if [[ "$quiet" != "true" ]]; then
2907-
log_item "ok" "checksums refresh" "synced from GitHub"
2908-
fi
2909-
log_to_file "Refreshed checksums.yaml from $CHECKSUMS_URL"
2910-
return 0
2911-
else
2912-
rm -f "$tmp_checksums"
2913-
[[ "$quiet" != "true" ]] && log_item "warn" "checksums refresh" "failed to install, using cached"
2914-
log_to_file "Checksums refresh failed: mv failed"
2915-
return 1
2904+
if update_curl \
2905+
--connect-timeout 5 \
2906+
--max-time 30 \
2907+
-H "Accept: application/vnd.github.raw" \
2908+
-H "X-GitHub-Api-Version: 2022-11-28" \
2909+
-o "$tmp_checksums" \
2910+
"$api_url" 2>/dev/null; then
2911+
fetched_source="$api_url"
2912+
elif update_curl --connect-timeout 5 --max-time 30 -o "$tmp_checksums" "$raw_url" 2>/dev/null; then
2913+
fetched_source="$raw_url"
2914+
else
2915+
rm -f "$tmp_checksums"
2916+
[[ "$quiet" != "true" ]] && log_item "warn" "checksums refresh" "network error, using cached"
2917+
log_to_file "Checksums refresh failed: network error"
2918+
return 1
2919+
fi
2920+
2921+
# Validate it looks like a checksums file.
2922+
if grep -q "^installers:" "$tmp_checksums" 2>/dev/null; then
2923+
if mv "$tmp_checksums" "$checksums_local" 2>/dev/null; then
2924+
chmod 644 "$checksums_local" 2>/dev/null || true # Ensure readable permissions
2925+
if [[ "$quiet" != "true" ]]; then
2926+
log_item "ok" "checksums refresh" "synced from GitHub"
29162927
fi
2928+
log_to_file "Refreshed checksums.yaml from $fetched_source"
2929+
return 0
29172930
else
29182931
rm -f "$tmp_checksums"
2919-
[[ "$quiet" != "true" ]] && log_item "warn" "checksums refresh" "invalid format, using cached"
2920-
log_to_file "Checksums refresh failed: invalid format"
2932+
[[ "$quiet" != "true" ]] && log_item "warn" "checksums refresh" "failed to install, using cached"
2933+
log_to_file "Checksums refresh failed: mv failed"
29212934
return 1
29222935
fi
29232936
else
29242937
rm -f "$tmp_checksums"
2925-
[[ "$quiet" != "true" ]] && log_item "warn" "checksums refresh" "network error, using cached"
2926-
log_to_file "Checksums refresh failed: network error"
2938+
[[ "$quiet" != "true" ]] && log_item "warn" "checksums refresh" "invalid format, using cached"
2939+
log_to_file "Checksums refresh failed: invalid format"
29272940
return 1
29282941
fi
29292942
}

‎tests/unit/lib/test_update.bats‎

Lines changed: 132 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -619,11 +619,141 @@ EOF
619619
@test "refresh_checksums: uses trusted update_curl helper" {
620620
local update="$PROJECT_ROOT/scripts/lib/update.sh"
621621

622-
run grep -F 'if update_curl --connect-timeout 5 --max-time 30 -o "$tmp_checksums" "$CHECKSUMS_URL" 2>/dev/null; then' "$update"
622+
run grep -F 'if update_curl \' "$update"
623623
assert_success
624624

625-
run grep -F 'curl "${_refresh_curl_args[@]}" -o "$tmp_checksums" "$CHECKSUMS_URL"' "$update"
625+
run grep -F 'elif update_curl --connect-timeout 5 --max-time 30 -o "$tmp_checksums" "$raw_url" 2>/dev/null; then' "$update"
626+
assert_success
627+
628+
run grep -F 'curl "${_refresh_curl_args[@]}" -o "$tmp_checksums"' "$update"
629+
assert_failure
630+
631+
run grep -F 'CHECKSUMS_URL=' "$update"
632+
assert_failure
633+
}
634+
635+
@test "refresh_checksums: prefers GitHub API over raw CDN" {
636+
local runtime_home
637+
local calls_file
638+
local checksums_file
639+
runtime_home="$(create_temp_dir)"
640+
calls_file="$BATS_TEST_TMPDIR/refresh-api-calls.log"
641+
checksums_file="$runtime_home/.acfs/checksums.yaml"
642+
643+
mkdir -p "$runtime_home/.acfs"
644+
export HOME="$runtime_home"
645+
export TARGET_HOME="$runtime_home"
646+
unset TARGET_USER
647+
export ACFS_HOME="$runtime_home/.acfs"
648+
export ACFS_CHECKSUMS_REF="main"
649+
650+
update_curl() {
651+
local output_file=""
652+
local url="${*: -1}"
653+
local i=1
654+
655+
while [[ $i -le $# ]]; do
656+
if [[ "${!i}" == "-o" ]]; then
657+
local next=$((i + 1))
658+
output_file="${!next}"
659+
break
660+
fi
661+
((i += 1))
662+
done
663+
664+
printf '%s\n' "$url" >> "$calls_file"
665+
case "$url" in
666+
https://api.github.com/repos/*/contents/checksums.yaml?ref=main)
667+
cat > "$output_file" <<'EOF'
668+
installers:
669+
mcp_agent_mail:
670+
url: "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh"
671+
sha256: "2222222222222222222222222222222222222222222222222222222222222222"
672+
EOF
673+
return 0
674+
;;
675+
https://raw.githubusercontent.com/*)
676+
return 22
677+
;;
678+
*)
679+
return 1
680+
;;
681+
esac
682+
}
683+
684+
run refresh_checksums true
685+
assert_success
686+
687+
run grep -F 'api.github.com/repos/Dicklesworthstone/agentic_coding_flywheel_setup/contents/checksums.yaml?ref=main' "$calls_file"
688+
assert_success
689+
690+
run grep -F 'raw.githubusercontent.com' "$calls_file"
626691
assert_failure
692+
693+
run grep -F 'mcp_agent_mail_rust/refs/heads/main/install.sh' "$checksums_file"
694+
assert_success
695+
}
696+
697+
@test "refresh_checksums: cache-busts raw fallback when GitHub API fails" {
698+
local runtime_home
699+
local calls_file
700+
local checksums_file
701+
runtime_home="$(create_temp_dir)"
702+
calls_file="$BATS_TEST_TMPDIR/refresh-raw-calls.log"
703+
checksums_file="$runtime_home/.acfs/checksums.yaml"
704+
705+
mkdir -p "$runtime_home/.acfs"
706+
export HOME="$runtime_home"
707+
export TARGET_HOME="$runtime_home"
708+
unset TARGET_USER
709+
export ACFS_HOME="$runtime_home/.acfs"
710+
export ACFS_CHECKSUMS_REF="feature/ref"
711+
712+
update_curl() {
713+
local output_file=""
714+
local url="${*: -1}"
715+
local i=1
716+
717+
while [[ $i -le $# ]]; do
718+
if [[ "${!i}" == "-o" ]]; then
719+
local next=$((i + 1))
720+
output_file="${!next}"
721+
break
722+
fi
723+
((i += 1))
724+
done
725+
726+
printf '%s\n' "$url" >> "$calls_file"
727+
case "$url" in
728+
https://api.github.com/*)
729+
return 22
730+
;;
731+
https://raw.githubusercontent.com/Dicklesworthstone/agentic_coding_flywheel_setup/feature/ref/checksums.yaml?cb=*)
732+
cat > "$output_file" <<'EOF'
733+
installers:
734+
mcp_agent_mail:
735+
url: "https://raw.githubusercontent.com/Dicklesworthstone/mcp_agent_mail_rust/refs/heads/main/install.sh"
736+
sha256: "3333333333333333333333333333333333333333333333333333333333333333"
737+
EOF
738+
return 0
739+
;;
740+
*)
741+
return 1
742+
;;
743+
esac
744+
}
745+
746+
run refresh_checksums true
747+
assert_success
748+
749+
run grep -F 'api.github.com/repos/Dicklesworthstone/agentic_coding_flywheel_setup/contents/checksums.yaml?ref=feature/ref' "$calls_file"
750+
assert_success
751+
752+
run grep -E 'raw.githubusercontent.com/.*/feature/ref/checksums.yaml\?cb=[0-9]+' "$calls_file"
753+
assert_success
754+
755+
run grep -F '3333333333333333333333333333333333333333333333333333333333333333' "$checksums_file"
756+
assert_success
627757
}
628758

629759
@test "self-update hash comparisons use trusted update_sha256_file helper" {

0 commit comments

Comments
 (0)