ben/dotfiles-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: pin the bws version instead of resolving it

Browse Source 
ensure_bws resolved the version from the GitHub releases list API. That
worked on the dev box and failed in a bare container with "could not
resolve the current bws version" — because the dev shell had `gh`
authenticated and the container did not. Unauthenticated, that endpoint
returns an empty array for this repo.

The obvious fallback does not work either: sdk-sm is a monorepo with
per-component tags, so /releases/latest redirects to python-v2.1.0 rather
than any bws release.

Release-download URLs need no auth, so BWS_PIN=2.1.0 and the published
sha256 makes bumping it safe. Same pattern as FZF_PIN.
This commit is contained in:
bcherb2
2026-08-17 11:23:16 -04:00
parent 400bd9b9f1
commit 68e16ad1ff
1 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dot_local/bin/executable_dotup
+16 -5
View File
@@ -379,6 +379,8 @@ norm() { printf '%s\n' "$*" | tr ' ' '\n' | grep . | tr '\n' ' ' | sed 's/ $//';
# Used wherever a URL that may carry a credential is about to be printed.
redact_url() { printf '%s\n' "$1" | sed 's#://[^/@]*@#://<redacted>@#'; }
BWS_PIN=2.1.0
# The Bitwarden Secrets Manager CLI, installed by the PRIVATE tier only.
#
# It cannot be a manifest row. `selected_packages` drops every row flagged
@@ -403,11 +405,20 @@ ensure_bws() {
*) err "no bws build for $(uname -m)"; return 1 ;;
esac ;;
esac
# sdk-sm is a monorepo with per-component tags, so the `latest` release is
# usually a python SDK rather than bws. Filter by tag prefix.
v=$(curl -fsSL 'https://api.github.com/repos/bitwarden/sdk-sm/releases?per_page=40' 2>/dev/null \
| sed -n 's/.*"tag_name": *"bws-v\([0-9.]*\)".*/\1/p' | head -1)
[ -n "$v" ] || { err "could not resolve the current bws version"; return 1; }
# Pinned, the same way fzf is, and for a better reason than caution.
#
# There is no way to resolve "the current bws" without authenticating.
# sdk-sm is a monorepo with per-component tags, so /releases/latest
# redirects to whatever shipped last — measured 2026-08-17, that is
# `python-v2.1.0`, not bws. And the unauthenticated releases LIST endpoint
# returns an empty array for this repo: an earlier version of this function
# resolved the version through it and worked on the dev box only because
# `gh` had authenticated that shell. In a bare container it returned nothing
# and the install failed with "could not resolve the current bws version".
#
# Release-download URLs need no auth at all, so pin and move on. Bump BWS_PIN
# deliberately; the checksum below is what makes that safe.
v=$BWS_PIN
b=https://github.com/bitwarden/sdk-sm/releases/download/bws-v$v
say " fetching bws $v"
curl -fsSL "$b/bws-$t-$v.zip" -o /tmp/bws.zip 2>/dev/null \