From 6132382cf24ba0984a93e99eaed0d4600cee752f Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 2 Sep 2026 15:40:00 +0000 Subject: [PATCH] Pin the published v0.4.1 wheel SHA-256 in install docs Record GitHub Release wheel bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531 from the Linux package-e2e artifact. Keep the v0.4.0 digest as history. Do not retag v0.4.0. Co-authored-by: Byte271 --- README.md | 2 +- docs/install.md | 23 +++++++++++++++++------ docs/website.md | 2 +- tests/test_install_release_hardening.py | 6 +++++- 4 files changed, 24 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index d5a1cebc..9f994e33 100644 --- a/README.md +++ b/README.md @@ -97,7 +97,7 @@ That prints `FuckMark 0.4.1` for this source tree. Do not pipe `https://d.q1z.org/mark` into a shell. The supported install is a clone or a checksummed GitHub Release wheel. See [`docs/install.md`](docs/install.md) and [`docs/website.md`](docs/website.md). -Last **published** wheel is still **v0.4.0** (SHA-256 `5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f`). That wheel does not implement `--text` / `--file`. Use this 0.4.1 tree or wait for the v0.4.1 GitHub Release. Do not retag v0.4.0. +Last **published** wheel is **v0.4.1** (SHA-256 `bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531`). Do not retag v0.4.0. The historical v0.4.0 wheel SHA-256 is `5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f` and does not implement `--text` / `--file`. If clipboard copy fails, pipe instead: `printf 'I do not agree.\n' | .venv/bin/fuckmark`. diff --git a/docs/install.md b/docs/install.md index 0bb0dcac..4cd63c7e 100644 --- a/docs/install.md +++ b/docs/install.md @@ -6,7 +6,7 @@ Prefer a browser over the CLI? After install, run `fuckmark web` to open the loc Do not pipe `https://d.q1z.org/mark` into a shell. The live website must match [`website.md`](website.md). -This source tree is **0.4.1**. The last published GitHub Release wheel is **v0.4.0**. That wheel does not implement `--text` or `--file`. Do not retag v0.4.0. The v0.4.1 wheel SHA-256 is recorded after the GitHub Release exists. +This source tree is **0.4.1**. The published GitHub Release wheel is **v0.4.1**. Do not retag v0.4.0. ## From this repository (works now) @@ -42,24 +42,35 @@ py -3.12 -m venv .venv .venv\Scripts\fuckmark.exe --version ``` -`python3 -m pip install git+https://github.com/byte271/FuckMark.git` installs the same product from `main` after this branch merges. +`python3 -m pip install git+https://github.com/byte271/FuckMark.git` installs the same product from `main`. ## Tagged wheel -v0.4.0 wheel SHA-256 (last published GitHub Release; missing `--text` / `--file`): +v0.4.1 wheel SHA-256 (published GitHub Release): ```text -5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f fuckmark-0.4.0-py3-none-any.whl +bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531 fuckmark-0.4.1-py3-none-any.whl ``` ```text python3 -m venv .venv -.venv/bin/python -m pip install https://github.com/byte271/FuckMark/releases/download/v0.4.0/fuckmark-0.4.0-py3-none-any.whl +.venv/bin/python -m pip install https://github.com/byte271/FuckMark/releases/download/v0.4.1/fuckmark-0.4.1-py3-none-any.whl ``` Download `SHA256SUMS.txt` from the same release and confirm the wheel digest before trusting the environment: ```text +https://github.com/byte271/FuckMark/releases/download/v0.4.1/SHA256SUMS.txt +``` + +The historical v0.4.0 wheel SHA-256 (missing `--text` / `--file`) is: + +```text +5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f fuckmark-0.4.0-py3-none-any.whl +``` + +```text +https://github.com/byte271/FuckMark/releases/download/v0.4.0/fuckmark-0.4.0-py3-none-any.whl https://github.com/byte271/FuckMark/releases/download/v0.4.0/SHA256SUMS.txt ``` @@ -73,7 +84,7 @@ That tag is not retagged. ## In-repo installer (tagged wheel + checksum) -These scripts download the GitHub Release wheel, verify `SHA256SUMS.txt`, install into a user virtualenv, and print `fuckmark --help`. They do not start the CLI, do not use sudo, and do not install Python. They default to `v0.4.1` once that GitHub Release exists. Until then, install from this clone as above. Override: `FUCKMARK_RELEASE_TAG=v0.4.0` for the last published wheel. +These scripts download the GitHub Release wheel, verify `SHA256SUMS.txt`, install into a user virtualenv, and print `fuckmark --help`. They do not start the CLI, do not use sudo, and do not install Python. They default to `v0.4.1`. Override: `FUCKMARK_RELEASE_TAG=v0.4.0` for the historical wheel that does not implement `--text` / `--file`. Linux / macOS, from a clone: diff --git a/docs/website.md b/docs/website.md index ff5c98a5..62fa9706 100644 --- a/docs/website.md +++ b/docs/website.md @@ -87,7 +87,7 @@ py -3.12 -m venv .venv .venv\Scripts\fuckmark.exe --version ``` -Tagged wheel: GitHub Release `SHA256SUMS.txt` only. Last published wheel: v0.4.0. Source tree: 0.4.1. +Tagged wheel: GitHub Release `SHA256SUMS.txt` only. Last published wheel: v0.4.1. Source tree: 0.4.1. ## Results to show, with boundaries diff --git a/tests/test_install_release_hardening.py b/tests/test_install_release_hardening.py index 28111e25..73e5bbb2 100644 --- a/tests/test_install_release_hardening.py +++ b/tests/test_install_release_hardening.py @@ -146,9 +146,13 @@ def test_install_docs_do_not_recommend_live_main_or_pipe_installers() -> None: assert "SHA256SUMS" in text or "pip install ." in text assert "python3 -m pip install ." in readme or ".venv/bin/python -m pip install ." in readme assert "releases/download/v0.4.0" not in readme - assert "releases/download/v0.4.0" in install + assert "releases/download/v0.4.1" in install + assert "fuckmark-0.4.1-py3-none-any.whl" in install assert "fuckmark-0.4.0-py3-none-any.whl" in install + assert "releases/download/v0.4.0" in install assert "SHA256SUMS" in install + assert "bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531" in readme + assert "bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531" in install assert "5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f" in readme assert "5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f" in install assert "cb4ee7b6c06d1dde8c612c237df78f68f8364bc74bf469086288e55a2d5c9325" in install