QA: Verify all download & installation routes (v1.1.0)

[mesrikanthreddy]

Context

All install/download paths were repointed from the dead YTTGlobalServices org to YTT-Global and bumped to v1.1.0. A separate CI bug also corrupted the Homebrew formula's checksums (fixed by hand for v1.1.0, pipeline fix in PR #16). Need a full clean-machine pass to confirm every route actually works end to end, not just that the URLs resolve.

Scope — verify each of these from a clean/fresh environment where possible

1. curl installer

• curl -fsSL https://raw.githubusercontent.com/YTT-Global/kshield/main/install.sh | bash on macOS (arm64 + x86_64 if available)
• Same on Linux (x86_64 + aarch64 if available)
• Binary lands in /usr/local/bin (or $KSHIELD_INSTALL_DIR), kshield --version reports 1.1.0

2. Homebrew

• brew untap ytt-global/tap first if previously tapped (clear cache)
• brew install ytt-global/tap/kshield — confirm formula fetches v1.1.0, all 4 platform checksums verify (no Error: SHA256 mismatch)
• kshield --version → 1.1.0
• brew test ytt-global/tap/kshield passes

3. npm

• Verify on both macOS and Linux if possible (different binary per platform)

4. pip / PyPI

• pip install kshield==1.1.0 in a fresh venv
• kshield-backend entrypoint starts without import errors
• Confirm pyproject.toml version (1.1.0) matches what's live at https://pypi.org/project/kshield/1.1.0/

5. CLI's own backend auto-download

• kshield init in a repo with no ~/.kshield yet — confirm it downloads backend.tar.gz from the same v1.1.0 GitHub Release tag as the CLI binary's compiled-in version (this URL is baked into the Rust binary via cli/src/setup.rs — regression-prone if CLI/backend versions ever drift)

6. VS Code extension

• Install from Marketplace: code --install-extension YTTGlobal.kshield-vscode
• Confirm it activates, connects to a locally running backend (kshield start), and scan-on-save works
• Separately: cd vscode-extension && npx @vscode/vsce package still produces a clean, warning-free .vsix (no missing icon/repository/license warnings)

7. Direct GitHub Release download

• Manually download all 4 kshield-*.tar.gz assets from https://github.com/YTT-Global/kshield/releases/tag/v1.1.0 and verify each against checksums.txt on the release page

Out of scope

Don't need to test Docker Compose / production Postgres setup here — that's covered by backend API testing (separate ticket).

[LohithCoders]

@mesrikanthreddy The npm could not validate npx kshield@1.1.0 init as the package/version was unavailable on npm. Separate ticket already created.

[LohithCoders]

@mesrikanthreddy pip / PyPI and VS Code extensionhas been tested succesfully with no errors.

[LohithCoders]

@mesrikanthreddy Attempted to validate the CLI's own backend auto-download by running kshield init in a clean environment. The test is currently blocked on Windows because the kshield CLI binary is not available/executable, so the download of backend.tar.gz from the v1.1.0 GitHub Release could not be verified.

[LohithCoders]

@mesrikanthreddy Direct GitHub Release Download: Successfully downloaded all four kshield-*.tar.gz release assets from the v1.1.0 GitHub Release. Verified that the downloaded artifacts match the published SHA-256 values in checksums.txt.

Status: PASS.