Skip to content

Pin the published v0.4.1 wheel SHA-256 in install docs #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cursor merged 1 commit into from
Sep 2, 2026
Merged

Pin the published v0.4.1 wheel SHA-256 in install docs #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ That prints `FuckMark 0.4.1` for this source tree.

Do not pipe `https://d.q1z.org/mark` into a shell. The supported install is a clone or a checksummed GitHub Release wheel. See [`docs/install.md`](docs/install.md) and [`docs/website.md`](docs/website.md).

Last **published** wheel is still **v0.4.0** (SHA-256 `5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f`). That wheel does not implement `--text` / `--file`. Use this 0.4.1 tree or wait for the v0.4.1 GitHub Release. Do not retag v0.4.0.
Last **published** wheel is **v0.4.1** (SHA-256 `bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531`). Do not retag v0.4.0. The historical v0.4.0 wheel SHA-256 is `5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f` and does not implement `--text` / `--file`.

If clipboard copy fails, pipe instead: `printf 'I do not agree.\n' | .venv/bin/fuckmark`.

Expand Down
23 changes: 17 additions & 6 deletions docs/install.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ Prefer a browser over the CLI? After install, run `fuckmark web` to open the loc

Do not pipe `https://d.q1z.org/mark` into a shell. The live website must match [`website.md`](website.md).

This source tree is **0.4.1**. The last published GitHub Release wheel is **v0.4.0**. That wheel does not implement `--text` or `--file`. Do not retag v0.4.0. The v0.4.1 wheel SHA-256 is recorded after the GitHub Release exists.
This source tree is **0.4.1**. The published GitHub Release wheel is **v0.4.1**. Do not retag v0.4.0.

## From this repository (works now)

Expand Down Expand Up @@ -42,24 +42,35 @@ py -3.12 -m venv .venv
.venv\Scripts\fuckmark.exe --version
```

`python3 -m pip install git+https://github.com/byte271/FuckMark.git` installs the same product from `main` after this branch merges.
`python3 -m pip install git+https://github.com/byte271/FuckMark.git` installs the same product from `main`.

## Tagged wheel

v0.4.0 wheel SHA-256 (last published GitHub Release; missing `--text` / `--file`):
v0.4.1 wheel SHA-256 (published GitHub Release):

```text
5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f fuckmark-0.4.0-py3-none-any.whl
bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531 fuckmark-0.4.1-py3-none-any.whl
```

```text
python3 -m venv .venv
.venv/bin/python -m pip install https://github.com/byte271/FuckMark/releases/download/v0.4.0/fuckmark-0.4.0-py3-none-any.whl
.venv/bin/python -m pip install https://github.com/byte271/FuckMark/releases/download/v0.4.1/fuckmark-0.4.1-py3-none-any.whl
```

Download `SHA256SUMS.txt` from the same release and confirm the wheel digest before trusting the environment:

```text
https://github.com/byte271/FuckMark/releases/download/v0.4.1/SHA256SUMS.txt
```

The historical v0.4.0 wheel SHA-256 (missing `--text` / `--file`) is:

```text
5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f fuckmark-0.4.0-py3-none-any.whl
```

```text
https://github.com/byte271/FuckMark/releases/download/v0.4.0/fuckmark-0.4.0-py3-none-any.whl
https://github.com/byte271/FuckMark/releases/download/v0.4.0/SHA256SUMS.txt
```

Expand All @@ -73,7 +84,7 @@ That tag is not retagged.

## In-repo installer (tagged wheel + checksum)

These scripts download the GitHub Release wheel, verify `SHA256SUMS.txt`, install into a user virtualenv, and print `fuckmark --help`. They do not start the CLI, do not use sudo, and do not install Python. They default to `v0.4.1` once that GitHub Release exists. Until then, install from this clone as above. Override: `FUCKMARK_RELEASE_TAG=v0.4.0` for the last published wheel.
These scripts download the GitHub Release wheel, verify `SHA256SUMS.txt`, install into a user virtualenv, and print `fuckmark --help`. They do not start the CLI, do not use sudo, and do not install Python. They default to `v0.4.1`. Override: `FUCKMARK_RELEASE_TAG=v0.4.0` for the historical wheel that does not implement `--text` / `--file`.

Linux / macOS, from a clone:

Expand Down
2 changes: 1 addition & 1 deletion docs/website.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@ py -3.12 -m venv .venv
.venv\Scripts\fuckmark.exe --version
```

Tagged wheel: GitHub Release `SHA256SUMS.txt` only. Last published wheel: v0.4.0. Source tree: 0.4.1.
Tagged wheel: GitHub Release `SHA256SUMS.txt` only. Last published wheel: v0.4.1. Source tree: 0.4.1.

## Results to show, with boundaries

Expand Down
6 changes: 5 additions & 1 deletion tests/test_install_release_hardening.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,9 +146,13 @@ def test_install_docs_do_not_recommend_live_main_or_pipe_installers() -> None:
assert "SHA256SUMS" in text or "pip install ." in text
assert "python3 -m pip install ." in readme or ".venv/bin/python -m pip install ." in readme
assert "releases/download/v0.4.0" not in readme
assert "releases/download/v0.4.0" in install
assert "releases/download/v0.4.1" in install
assert "fuckmark-0.4.1-py3-none-any.whl" in install
assert "fuckmark-0.4.0-py3-none-any.whl" in install
assert "releases/download/v0.4.0" in install
assert "SHA256SUMS" in install
assert "bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531" in readme
assert "bbea9c0c4a5f50f84f452675f65e892794229fd5a19c6b34df05ee98d4de1531" in install
assert "5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f" in readme
assert "5a6ac62c8bb8d7ddd9e5bc9cb6cee6e3eb181ac5f397b4a6645ef86468ee932f" in install
assert "cb4ee7b6c06d1dde8c612c237df78f68f8364bc74bf469086288e55a2d5c9325" in install
Expand Down
Loading