From e1694f2e4546149b3405d733138824b973b37723 Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Tue, 11 Aug 2026 06:55:01 -0400 Subject: [PATCH] chore(release): 0.4.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ships the security audit: #46, #47, #50 and #51. All four are on main and none are reaching anyone — the endpoint serves what PINS says, and PINS still points at v0.4.1, which predates every one of them. install.sh on main f38612c071bcd6d4... served (v0.4.1) 639b4167471082c6... What this releases: #46 install-hooks.{sh,ps1} fetched six executables from a mutable branch with no verification, chmod +x'd them, and pointed core.hooksPath at them — on every fresh onboard, since resq is installed after hooks run. Now pinned and digest-checked, failing closed. #47 TLS pinning across scripts/lib; nix.sh piped 4xx bodies into sh; bun.sh fetched schemelessly; docker.sh used apt-key, which grants the Docker key authority over every repository on the system. #50 Nix installer pinned to a versioned URL and verified; Docker installed from its GPG-signed apt repo rather than get.docker.com; installer failures no longer report success; Debian and Ubuntu suites resolved correctly. #51 Bun's installer pinned to a tagged copy and verified. Merging this is the release. Merging the pin-bump PR that follows is what changes the served bytes. Co-Authored-By: Claude Opus 5 (1M context) --- VERSION | 2 +- install.ps1 | 2 +- install.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/VERSION b/VERSION index 267577d..2b7c5ae 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.4.1 +0.4.2 diff --git a/install.ps1 b/install.ps1 index d761784..dd200e8 100644 --- a/install.ps1 +++ b/install.ps1 @@ -33,7 +33,7 @@ $ErrorActionPreference = 'Stop' # GENERATED — stamped from VERSION by bin/stamp.sh. Do not edit by hand: CI # re-runs the stamper and fails if the committed value differs. -$ScriptVersion = '0.4.1' +$ScriptVersion = '0.4.2' $Org = 'resq-software' # Pinned to a version rather than the rolling endpoint, and digest-checked # before it runs — mirrors install.sh. required.yml re-checks the digest against diff --git a/install.sh b/install.sh index 93add91..964ba06 100755 --- a/install.sh +++ b/install.sh @@ -44,7 +44,7 @@ fi # install.sh keeps verifying against the digest it actually shipped with rather # than against whatever happens to be current. release.yml refuses to publish a # tag whose version disagrees with this value. -SCRIPT_VERSION="0.4.1" +SCRIPT_VERSION="0.4.2" # Everything this script creates belongs to the invoking user alone. Set before # the first mkdir/mktemp so nothing is even briefly group- or world-readable.