From 68e16ad1ff35bf91ac160d66db76d3e0a8ecad85 Mon Sep 17 00:00:00 2001 From: bcherb2 Date: Mon, 17 Aug 2026 11:23:16 -0400 Subject: [PATCH] fix: pin the bws version instead of resolving it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ensure_bws resolved the version from the GitHub releases list API. That worked on the dev box and failed in a bare container with "could not resolve the current bws version" — because the dev shell had `gh` authenticated and the container did not. Unauthenticated, that endpoint returns an empty array for this repo. The obvious fallback does not work either: sdk-sm is a monorepo with per-component tags, so /releases/latest redirects to python-v2.1.0 rather than any bws release. Release-download URLs need no auth, so BWS_PIN=2.1.0 and the published sha256 makes bumping it safe. Same pattern as FZF_PIN. --- dot_local/bin/executable_dotup | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/dot_local/bin/executable_dotup b/dot_local/bin/executable_dotup index 2f0d12a..9128229 100755 --- a/dot_local/bin/executable_dotup +++ b/dot_local/bin/executable_dotup @@ -379,6 +379,8 @@ norm() { printf '%s\n' "$*" | tr ' ' '\n' | grep . | tr '\n' ' ' | sed 's/ $//'; # Used wherever a URL that may carry a credential is about to be printed. redact_url() { printf '%s\n' "$1" | sed 's#://[^/@]*@#://@#'; } +BWS_PIN=2.1.0 + # The Bitwarden Secrets Manager CLI, installed by the PRIVATE tier only. # # It cannot be a manifest row. `selected_packages` drops every row flagged @@ -403,11 +405,20 @@ ensure_bws() { *) err "no bws build for $(uname -m)"; return 1 ;; esac ;; esac - # sdk-sm is a monorepo with per-component tags, so the `latest` release is - # usually a python SDK rather than bws. Filter by tag prefix. - v=$(curl -fsSL 'https://api.github.com/repos/bitwarden/sdk-sm/releases?per_page=40' 2>/dev/null \ - | sed -n 's/.*"tag_name": *"bws-v\([0-9.]*\)".*/\1/p' | head -1) - [ -n "$v" ] || { err "could not resolve the current bws version"; return 1; } + # Pinned, the same way fzf is, and for a better reason than caution. + # + # There is no way to resolve "the current bws" without authenticating. + # sdk-sm is a monorepo with per-component tags, so /releases/latest + # redirects to whatever shipped last — measured 2026-08-17, that is + # `python-v2.1.0`, not bws. And the unauthenticated releases LIST endpoint + # returns an empty array for this repo: an earlier version of this function + # resolved the version through it and worked on the dev box only because + # `gh` had authenticated that shell. In a bare container it returned nothing + # and the install failed with "could not resolve the current bws version". + # + # Release-download URLs need no auth at all, so pin and move on. Bump BWS_PIN + # deliberately; the checksum below is what makes that safe. + v=$BWS_PIN b=https://github.com/bitwarden/sdk-sm/releases/download/bws-v$v say " fetching bws $v" curl -fsSL "$b/bws-$t-$v.zip" -o /tmp/bws.zip 2>/dev/null \