fix(catalog): repoint speckit-inventory and inventory-alignment at live release artifacts - #4449
Open
Yash-Chindam wants to merge 1 commit into
Open
Conversation
…ve artifacts Both entries pointed at release assets under a repository that no longer existed, so `specify extension add speckit-inventory` and `specify preset add inventory-alignment` failed for everyone: the download 404s before sha256 verification is ever reached. The v0.1.0 archives are unrecoverable, so they are superseded by v0.1.1 from a restored source repository and the pinned digests change with them. Also raises the preset's speckit_version floor from >=0.9.0 to >=1.0.4. The old floor was wrong once the entry declared requires.extensions: that field first shipped in v1.0.4 (github#4250), so a v0.9 CLI would install the preset while silently ignoring the dependency it declares. Verified: both download_urls return 200 and their SHA-256 matches the pinned value, CatalogEntry parses both entries, and tests/contract/test_catalog_schema.py passes (45 tests). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Both community entries I submitted in #4226 and #4227 point at release assets under a repository that no longer exists:
repository,homepage,documentation,changelog, anddownload_urlall 404. Installation fails at the download, beforeverify_archive_sha256is ever reached:This is my fault, and I'm sorry it reached the catalog in that state.
Fix
I've restored the source in a standalone repository and cut v0.1.1. The v0.1.0 archives are unrecoverable — nothing reproduces their pinned digests — so v0.1.1 supersedes them and the pinned SHA-256 values change with it.
speckit-inventoryv0.1.0,9ebf004e…v0.1.1,df735fe7…inventory-alignmentv0.1.0,8ea62813…v0.1.1,227db99a…Release artifacts are built with sorted members, a fixed timestamp, and two canonical permission modes — mirroring
bundler/services/packager.py— and.gitattributespinseol=lfso a Windows checkout cannot yield a different digest. A clean clone reproduces both digests byte for byte.One correctness fix beyond the URLs
The preset entry declares
requires.extensions, but claimedspeckit_version: ">=0.9.0". That floor is wrong:requires.extensionsfirst shipped in v1.0.4 (#4250) —v1.0.3has no_validate_requires_extensions,v1.0.4does. A v0.9 CLI would install the preset and ignore the dependency it declares, which is the exact silent-no-op failure #4250 set out to prevent. Raised to>=1.0.4.Verification
download_urls return HTTP 200, and the downloaded bytes hash to the pinnedsha256(checked against the live URLs, not local files).CatalogEntry.from_dict()parses both entries.tests/contract/test_catalog_schema.py— 45 passed.PresetManifest/ExtensionManifest, and the extension's own suite passes (9 tests).Diff is 9 lines across the two catalogs; no other entry is touched.
🤖 Generated with Claude Code