Upgrade vendorpull to 89f348a97842e05aeab45d338d41fb02031fad62 - #112
Conversation
Signed-off-by: Juan Cruz Viotti <jv@jviotti.com>
🤖 Augment PR SummarySummary: Upgrades the vendored Changes:
Technical note: For file dependencies, the “version” field now represents the SHA‑256 of the downloaded artifact (not a git ref). 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| checksum() { | ||
| if command -v sha256sum > /dev/null | ||
| then | ||
| sha256sum "$1" | cut -d ' ' -f 1 |
There was a problem hiding this comment.
vendor/vendorpull/pull:29 — checksum() uses pipelines (e.g., sha256sum ... | cut ...), so an upstream failure can be masked and return an empty checksum. In upgrade, that would allow $NEW_VERSION to become empty and still update DEPENDENCIES.
Severity: medium
Other Locations
vendor/vendorpull/pull:32vendor/vendorpull/pull:35vendor/vendorpull/upgrade:27vendor/vendorpull/upgrade:30vendor/vendorpull/upgrade:33
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
|
|
||
| # $1 = version | ||
| is_file_dependency() { | ||
| echo "$1" | grep -Eq '^[a-f0-9]{64}$' |
There was a problem hiding this comment.
vendor/vendorpull/pull:22 — is_file_dependency() only matches lowercase hex ([a-f0-9]{64}), so an uppercase SHA-256 string in DEPENDENCIES would be treated as a git dependency and likely fail the intended download flow.
Severity: low
Other Locations
vendor/vendorpull/upgrade:20
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| # Downloading | ||
| log "Downloading $2 into $4/$1" | ||
| mkdir -p "$(dirname "$4/$1")" | ||
| curl --fail --silent --show-error --location --output "$4/$1" "$2" |
There was a problem hiding this comment.
vendor/vendorpull/pull:109 — Downloading via curl --output will create the vendored file with local default permissions (umask), which may differ from any previously-vendored mode. If a file dependency is expected to be executable, this could break consumers.
Severity: medium
Other Locations
vendor/vendorpull/upgrade:73
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
1 participant
Signed-off-by: Juan Cruz Viotti jv@jviotti.com