From e830415266822948b0ae271e2ba25cd6576874f0 Mon Sep 17 00:00:00 2001 From: Zack Whitson Date: Fri, 7 Aug 2026 16:26:05 -0500 Subject: [PATCH] Stop naming versions the README cannot keep current MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three places named a specific version and all three had gone stale. The worst was a claim that npm "currently trails the website at 0.2.24" — npm serves 0.2.41, so the page was telling readers something false about our own distribution. The pin example and the attestation example both still pointed at 0.2.39, which is also the one recent release carrying two attestation predicates instead of three, so anyone following it got a weaker verification than we ship. Replaced with placeholders, a link to npm for what npm actually serves, and codetruss-cli-latest.tgz for readers who just want the current release. Verified latest.tgz is a valid npm tarball, contains 0.2.45, and is byte-identical to the versioned archive. Co-Authored-By: Claude Opus 5 --- README.md | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 1ddf535..9059b96 100644 --- a/README.md +++ b/README.md @@ -50,13 +50,20 @@ and verify its published SHA-256 digest before installing. To pin an exact version, install the immutable archive directly: ```bash +# every published version, immutable, at a stable URL npm install --global --ignore-scripts --no-audit --no-fund \ - https://codetruss.com/downloads/codetruss-cli-0.2.39.tgz + https://codetruss.com/downloads/codetruss-cli-.tgz + +# or the current release, without naming a version +npm install --global --ignore-scripts --no-audit --no-fund \ + https://codetruss.com/downloads/codetruss-cli-latest.tgz ``` -The `@codetruss/cli` package on the npm registry is published as a separate, -manually dispatched step and currently trails the website at `0.2.24`. Use the -installers or the versioned archive above for the current release. +The `@codetruss/cli` package on the npm registry is published by a separate, +manually approved step, so it can trail the website by a release or two. Check +[npmjs.com/package/@codetruss/cli](https://www.npmjs.com/package/@codetruss/cli) +for what npm currently serves; the installers and the archives above are always +the current release. ## First run @@ -325,8 +332,8 @@ clean global install. Verify a downloaded release yourself: ```bash -gh attestation verify codetruss-cli-0.2.39.tgz --repo CodeTruss/codetruss-cli -shasum -a 256 -c codetruss-cli-0.2.39.tgz.sha256 +gh attestation verify codetruss-cli-.tgz --repo CodeTruss/codetruss-cli +shasum -a 256 -c codetruss-cli-.tgz.sha256 ``` Maintainers should follow [docs/RELEASE.md](docs/RELEASE.md). Tag-driven GitHub