fix(#16): pinned-version regex accepts dotted -rc.N + legacy -rcN #18

Merged

jsutter merged 1 commit from fix/16-17-installer-rc-dotted into main

2026-09-09 20:51:39 +00:00

jsutter commented

2026-09-09 20:46:17 +00:00

Owner

Observed (2026-09-09, during the dito-sf1 host provisioning wave)

The installer validates a pinned version against the regex ^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$. It only matches a single-digit rc suffix (-rc1 .. -rc9). Every real rc release tag is the DOTTED form v4.1.12-rc.3 / v4.1.12-rc.4, which the regex rejects.

Repro:

bash -s -- dito v4.1.12-rc.3 -> "Invalid version" (the dot after rc is rejected).
Forcing a single-digit form v4.1.12-rc3 passes validation, but the downloader builds the URL from the version string, so it requests releases/download/dito-v4.1.12-rc3 — a version that does not match any release tag (the tag is dito-v4.1.12-rc.3), so the download 404s.

Cause

The validation regex and the download-URL derivation both key off the version string. A single-digit coercion (rc3) survives validation but 404s on download. The two real rc tags (rc.3, rc.4) survive neither.

Fix

Broaden the pinned-version regex in both installers to accept the dotted rc form:
^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+\.[0-9]+)?
Mirror the change in install.ps1 and keep the two harness tests (install-signing.sh asserts the install.sh regex; install-ps1-signing.ps1 mirrors it) in sync — the binary/skill lockstep convention applies.

Why it matters

This blocked the 2026-09-09 dito-sf1 wave. The operator had to manually download + minisign-verify the rc.3 binary by hand instead of the pinned-installer path.

Acceptance

bash -s -- dito v4.1.12-rc.4 validates and the downloader requests releases/download/dito-v4.1.12-rc.4 (matches the release tag dito-v4.1.12-rc.4).
install.sh + install.ps1 regex in sync; the two harness tests pass.

## Observed (2026-09-09, during the dito-sf1 host provisioning wave) The installer validates a pinned version against the regex `^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$`. It only matches a single-digit rc suffix (`-rc1` .. `-rc9`). Every real rc release tag is the DOTTED form `v4.1.12-rc.3` / `v4.1.12-rc.4`, which the regex rejects. Repro: - `bash -s -- dito v4.1.12-rc.3` -> "Invalid version" (the dot after `rc` is rejected). - Forcing a single-digit form `v4.1.12-rc3` passes validation, but the downloader builds the URL from the version string, so it requests `releases/download/dito-v4.1.12-rc3` — a version that does not match any release tag (the tag is `dito-v4.1.12-rc.3`), so the download 404s. ## Cause The validation regex and the download-URL derivation both key off the version string. A single-digit coercion (`rc3`) survives validation but 404s on download. The two real rc tags (`rc.3`, `rc.4`) survive neither. ## Fix Broaden the pinned-version regex in both installers to accept the dotted rc form: `^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+\.[0-9]+)?` Mirror the change in install.ps1 and keep the two harness tests (install-signing.sh asserts the install.sh regex; install-ps1-signing.ps1 mirrors it) in sync — the binary/skill lockstep convention applies. ## Why it matters This blocked the 2026-09-09 dito-sf1 wave. The operator had to manually download + minisign-verify the rc.3 binary by hand instead of the pinned-installer path. ## Acceptance - `bash -s -- dito v4.1.12-rc.4` validates and the downloader requests `releases/download/dito-v4.1.12-rc.4` (matches the release tag `dito-v4.1.12-rc.4`). - install.sh + install.ps1 regex in sync; the two harness tests pass.

jsutter added 1 commit

2026-09-09 20:46:17 +00:00

fix(#16 ): pinned-version regex accepts dotted -rc.N and legacy -rcN ad84f71e05

The installer's pinned-version validation only matched a single-digit rc
suffix (-rc1..-rc9), so every real rc release tag (v4.1.12-rc.3/rc.4,
dotted form) was rejected. Broadened the regex to accept both the legacy
single-digit and the current dotted forms, keeping install.sh and
install.ps1 in sync plus the two harness tests.

Verified: bash tests/install-signing.sh passes (minisign present).

jsutter merged commit 12611b0907 into main

2026-09-09 20:51:39 +00:00

jsutter referenced this pull request from a commit

2026-09-09 20:51:41 +00:00

Merge pull request 'fix(#16): pinned-version regex accepts dotted -rc.N + legacy -rcN' (#18) from fix/16-17-installer-rc-dotted into main