install.sh: pinned-version regex rejects the dotted -rc.N form (can't install rc.3/rc.4) #16
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Observed (2026-09-09, during the dito-sf1 host provisioning wave)
The installer validates a pinned version against the regex
^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$. It only matches a single-digit rc suffix (-rc1..-rc9). Every real rc release tag is the DOTTED formv4.1.12-rc.3/v4.1.12-rc.4, which the regex rejects.Repro:
bash -s -- dito v4.1.12-rc.3-> "Invalid version" (the dot afterrcis rejected).v4.1.12-rc3passes validation, but the downloader builds the URL from the version string, so it requestsreleases/download/dito-v4.1.12-rc3— a version that does not match any release tag (the tag isdito-v4.1.12-rc.3), so the download 404s.Cause
The validation regex and the download-URL derivation both key off the version string. A single-digit coercion (
rc3) survives validation but 404s on download. The two real rc tags (rc.3,rc.4) survive neither.Fix
Broaden the pinned-version regex in both installers to accept the dotted rc form:
^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+\.[0-9]+)?Mirror the change in install.ps1 and keep the two harness tests (install-signing.sh asserts the install.sh regex; install-ps1-signing.ps1 mirrors it) in sync — the binary/skill lockstep convention applies.
Why it matters
This blocked the 2026-09-09 dito-sf1 wave. The operator had to manually download + minisign-verify the rc.3 binary by hand instead of the pinned-installer path.
Acceptance
bash -s -- dito v4.1.12-rc.4validates and the downloader requestsreleases/download/dito-v4.1.12-rc.4(matches the release tagdito-v4.1.12-rc.4).Verified already fixed upstream (
ad84f71via PR #18, merged12611b0before this pass): both installers accept the dotted -rc.N form (regex -rc([0-9]+|.[0-9]+)) and the pinned path copies the version verbatim into the download URL (no coercion). Behavioral coverage added on main (tests/install_version_parsing.sh, 11 validator + 3 E2E cases incl. the no-coerced-URL assertion).