release: no SHA256SUMS, no checksum step in the docs (#60) by compot-dev · Pull Request #61 · OpenIPC/vectis

compot-dev · 2026-10-17T22:56:54Z

Closes #60.

build.yml, release job: the per-build checksums are no longer merged into a published SHA256SUMS; the release has the two binaries only. The notes drop the "Check: sha256sum -c SHA256SUMS" line.
READMEs (all three): Quick start and "Releases and permanent links" — download and install/chmod, no checksum step; SHA256SUMS is gone from the links table and the text.
Unchanged, internal to CI: ci/build-static.sh and ci/build-mipsel.sh still write a SHA256SUMS into their own artifact, and the release job checks it when it takes the binaries over between jobs (ci/ is not touched, so no version bump); the pinned checksum of the mipsel toolchain stays.

Workflow and docs only.

Users need not check the downloaded binaries against checksums: the release job no longer merges the per-build checksums into a published SHA256SUMS, and the release notes drop the "Check:" line. READMEs: the Quick start and the permanent-links section download and chmod/install only, and SHA256SUMS is gone from the links table. Unchanged, internal to CI: ci/build-static.sh and ci/build-mipsel.sh still write a SHA256SUMS into their own artifact, and the release job checks it when it takes the binaries over (so this needs no version bump); the pinned checksum of the mipsel toolchain stays. Closes #60

qodo-free-for-open-source-projects · 2026-10-17T22:57:23Z

PR Summary by Qodo

Publish releases without SHA256SUMS

⚙️ Configuration changes 📝 Documentation 🕐 10-20 Minutes

AI Description

• Publish only the two static binaries while retaining checksum verification between CI jobs.
• Remove checksum instructions and links from release notes and all three READMEs.

Diagram

graph TD
  Builds["Static builds"] --> Artifacts["CI artifacts"] --> Verify["Checksum validation"] --> Stage["Binary staging"] --> Release["Latest release"] --> Users["Binary downloads"]
  Docs["Three READMEs"] --> Users

High-Level Assessment

Keep the PR’s approach: it removes the public checksum asset and obsolete instructions while preserving verification at the CI artifact boundary. Removing internal checks would weaken the build-to-release handoff without advancing the stated goal.

Files changed (4) +15 / -25

Documentation (3) +12 / -21

README.mdRemove public checksum steps from English instructions +4/-7

Remove public checksum steps from English instructions

• Quick start and permanent-link examples now download and install or chmod the binary without a checksum step. The release description and links table no longer list SHA256SUMS.

README.md

README.ru.mdAlign Russian release instructions with binary-only downloads +4/-7

Align Russian release instructions with binary-only downloads
• Removes checksum downloads, verification commands, and the SHA256SUMS release link while retaining the binary installation steps.
README.ru.md

README.zh-CN.mdAlign Chinese release instructions with binary-only downloads +4/-7

Align Chinese release instructions with binary-only downloads
• Removes checksum downloads, verification commands, and the SHA256SUMS release link while retaining the binary installation steps.
README.zh-CN.md

Other (1) +3 / -4

build.ymlStop publishing the merged checksum file +3/-4

Stop publishing the merged checksum file

• The release job still verifies each build artifact’s SHA256SUMS but no longer copies checksums into the publication directory. Release notes no longer instruct users to check a SHA256SUMS file.

.github/workflows/build.yml

qodo-free-for-open-source-projects · 2026-10-17T22:58:02Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Changelog promises a missing release file 🐞 Bug ≡ Correctness

Description

The release job no longer copies SHA256SUMS into dist, but the 1.9.0 changelog still says the
release has a checksum file covering both binaries. Because PROGRAM_VERSION remains 1.9.0 and the
job replaces the only release with dist/*, that statement describes the current release but points
readers to an asset it no longer contains.

Code

.github/workflows/build.yml[216]

-            cat "artifacts/$a/SHA256SUMS" >> dist/SHA256SUMS

Evidence
The removed staging line previously put the checksum file in dist; the current job stages binaries
only and publishes dist/*. The changelog still describes a checksum file for version 1.9.0, which
remains the program version.
.github/workflows/build.yml[211-217]
.github/workflows/build.yml[254-261]
CHANGELOG.md[8-21]
vectis.c[105-105]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The current 1.9.0 changelog says the release includes a checksum file, but the release job no longer publishes one.
## Fix Focus Areas
- CHANGELOG.md[18-21]
## Recommended Fix
Update the current-version release entry to describe the two published binaries without promising a `SHA256SUMS` asset.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~Failed downloads can install an old binary~~ ✓ Resolved

Description

The Quick start now runs install unconditionally after curl, rather than gating it on a
successful download and checksum check. If the download fails while a same-named file remains from
an earlier attempt, the example installs that file; the permanent-link examples likewise run chmod
on it, and all three READMEs have this pattern.

Code

README.md[53]

+install -m 755 vectis-linux-x86_64 vectis

Evidence

The new Quick start places curl -fsSLO and install on separate shell lines without a
conditional; the permanent-link example does the same for chmod. The corresponding examples in the
Russian and Chinese READMEs mirror these commands, so a failed download does not prevent the
following operation when the file already exists.

README.md[50-56]
README.md[179-182]
README.ru.md[51-57]
README.zh-CN.md[47-53]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The README examples continue to install or chmod a previously downloaded binary when the latest download fails.
## Fix Focus Areas
- README.md[51-53]
- README.md[180-181]
- README.ru.md[52-54]
- README.ru.md[183-184]
- README.zh-CN.md[48-50]
- README.zh-CN.md[172-173]
## Recommended Fix
Join each download to its following `install` or `chmod` command with `&&`, so a failed `curl` stops that operation in every language.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Tip of the day

💡 Did you know, you can see how risky a PR is at a glance with blast radius labels

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Qodo on #61: with curl and install on separate lines, a failed download would install a file left from an earlier attempt. The examples chain them with &&. Refs #60

compot-dev · 2026-10-17T23:00:17Z

Qodo finding (failed downloads can install an old binary): fixed in e935e72 — in all three READMEs the Quick start and the permanent-links example run install / chmod only after curl -fsSLO … && succeeded.

compot-dev · 2026-10-17T23:00:18Z

/review

As in OpenIPC/vectis#61: a failed curl must not leave chmod working on a file from an earlier attempt. Refs #48

qodo-free-for-open-source-projects · 2026-10-17T23:01:40Z

          for a in vectis-x86_64-static vectis-mipsel-static; do
            (cd "artifacts/$a" && sha256sum -c SHA256SUMS)
            cp artifacts/$a/vectis-linux-* dist/
-            cat "artifacts/$a/SHA256SUMS" >> dist/SHA256SUMS


1. Changelog promises a missing release file 🐞 Bug ≡ Correctness

The release job no longer copies SHA256SUMS into dist, but the 1.9.0 changelog still says the release has a checksum file covering both binaries. Because PROGRAM_VERSION remains 1.9.0 and the job replaces the only release with dist/*, that statement describes the current release but points readers to an asset it no longer contains.

Agent Prompt

## Issue description The current 1.9.0 changelog says the release includes a checksum file, but the release job no longer publishes one. ## Fix Focus Areas - CHANGELOG.md[18-21] ## Recommended Fix Update the current-version release entry to describe the two published binaries without promising a `SHA256SUMS` asset.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-free-for-open-source-projects · 2026-10-17T23:01:42Z

Code review by qodo was updated up to the latest commit e935e72

compot-dev · 2026-10-17T23:09:12Z

Qodo: changelog promises a missing release file — not adopted: the 1.8.0 section records what that version shipped (SHA256SUMS was in its release); CHANGELOG.md is history and is not rewritten. The next version's section will say that releases no longer carry SHA256SUMS.

qodo-free-for-open-source-projects · 2026-10-17T23:09:23Z

Qodo: changelog promises a missing release file — not adopted: the 1.8.0 section records what that version shipped (SHA256SUMS was in its release); CHANGELOG.md is history and is not rewritten. The next version's section will say that releases no longer carry SHA256SUMS.

For finding 1, that distinction is valid: if the SHA256SUMS reference is only in the historical 1.8.0 entry, it should remain unchanged. The finding incorrectly treats it as describing the current release; the intended fix would instead be to document the changed release contents in the next version’s changelog entry. No dismissal was applied.

qodo-free-for-open-source-projects Bot reviewed Oct 17, 2026

View reviewed changes

Comment thread README.md Resolved

docs: install or chmod only after a successful download (#60)

e935e72

Qodo on #61: with curl and install on separate lines, a failed download would install a file left from an earlier attempt. The examples chain them with &&. Refs #60

compot-dev added a commit to OpenIPC/vtesse that referenced this pull request Oct 17, 2026

docs: chmod only after a successful download (#48)

dd533ae

As in OpenIPC/vectis#61: a failed curl must not leave chmod working on a file from an earlier attempt. Refs #48

qodo-free-for-open-source-projects Bot reviewed Oct 17, 2026

View reviewed changes

compot-dev merged commit 13671ee into master Oct 17, 2026
16 checks passed

compot-dev deleted the release/no-sha256sums branch October 17, 2026 23:09

Navigation Menu

Repository navigation

release: no SHA256SUMS, no checksum step in the docs (#60) - #61

release: no SHA256SUMS, no checksum step in the docs (#60)#61
compot-dev merged 2 commits into
masterfrom
release/no-sha256sums

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

PR Summary by Qodo

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot Oct 17, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

compot-dev commented Oct 17, 2026

Uh oh!

qodo-free-for-open-source-projects Bot commented Oct 17, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qodo-free-for-open-source-projects Bot commented Oct 17, 2026 •

edited

Loading