[claude]

Requested by Samuel Attard · Slack thread

Moves the rbe credential helper tag and per-platform sha256 hashes out of reclient.ts into src/utils/rbe-credential-helper.json. It also adds a Faraday config that trusts electron-roller[bot] for that file only. That way the automatic bump PRs from electron/roller#223 change data, not code, and need just one approval.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SRpnCfe3GVUxrP8zoGTsVG

[claude]

I reviewed this PR and didn't find any bugs. A human should still look, because the new Faraday config lets a bot change the one file that decides which credential-helper binary gets downloaded and which hash it has to match.

What was reviewed:

• The move from the constants to the JSON pin. The tag and all six per-platform hashes match the removed constants. The tag-file cache check and the tag written at the end now both use the JSON tag.
• The missing-hash check now runs before cleanup and download. If the hash is empty or missing, it calls fatal() instead of downloading and then failing the comparison.
• Packaging: copy-assets.js now copies the JSON into dist/utils next to reclient.js. package.json has no files list that would leave it out.
• Ruled out: the unchecked tag in the URL. Whatever path the tag points to, the downloaded file still has to match a hash from the same reviewed pin.

Extended reasoning...

The change moves the reclient credential-helper version and its sha256 hashes from reclient.ts into a JSON data file and ships that file with the build. It also adds .github/faraday.yml, which trusts electron-roller[bot] to change that file. That is a supply-chain trust decision: the roller would control both the binary's download location and the hash it is checked against. The code change itself is small and behaves the same as before. A CODEOWNERS rule (* -> wg-infra plus one individual) covers every changed file. The one existing approval came before the last two commits.