Repository navigation
fix(skill): installer-release verifies the bundle .exe download before signing it - #1821
Merged
Merged
Conversation
…e signing it Phase 4.5 signed whatever gh release download left on disk. On a slow link the download stopped at 26.77 of 63.95 MB, and that truncated file was signed and uploaded over the good CI asset: the live bundle v2.5.8 .exe was broken for ~20 min (2026-10-03). - Download with retries and require the file size to equal the release asset's; otherwise skip signing and leave the CI asset alone. - Refuse to upload a signed file that is not larger than the original (a signature only adds bytes). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On bundle v2.5.8 (2026-10-03), Phase 4.5 signed a truncated download: 26.77 of 63.95 MB, from a slow link. It then uploaded that file over the good CI asset, and the live Windows bundle installer was broken for about 20 minutes. It was recovered from the CI artifact, re-signed, and is now correct (63,963,528 bytes, signed).
Changes, in
.claude/skills/installer-release/SKILL.mdonly:The edited bash block passes
bash -n.🤖 Generated with Claude Code