[WRONG BRANCH] release(main): carry Windows checksum record support by lidge-jun · Pull Request #5552 · lidge-jun/opencodex

lidge-jun · 2026-09-22T13:04:59Z

Summary

Accept the standard SHA-256 binary-mode marker emitted by Windows sha256sum, alongside the existing text-mode marker. Accept LF and CRLF record terminators.
Dry-run 35728908862 successfully packaged every platform but its final verification rejected the valid Windows record containing a space and asterisk before the archive name.
Preserve exact checksum-to-payload filename binding, payload existence and byte-level hash verification. Regression cases cover the known empty-file digest, both line endings, invalid markers, wrong filename, tampering and missing files.

Verification

Hosted failure: https://github.com/lidge-jun/opencodex/actions/runs/35728908862/job/106754846550.
Two independent Sol source/security reviews passed. Local tests, builds, typechecks and cryptographic execution: NOT RUN by owner instruction.
Hosted exact-head verification remains pending. Owner authorized immediate main promotion of merged dev PR fix(release): accept Windows binary checksum records #5550, followed by immediate actual deployment without a separate dry-run or pre-dispatch CI wait. Commit/push use --no-verify.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed: checksum format comment updated.
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

chatgpt-codex-connector · 2026-09-22T13:05:04Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

coderabbitai · 2026-09-22T13:05:28Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 780a8fb4-f688-45dd-9196-13fb7914c9fa

📥 Commits

Reviewing files that changed from the base of the PR and between b1ae178 and 3a54428.

📒 Files selected for processing (2)

desktop/scripts/verify-release-assets.ts
tests/ci-workflows/release-desktop-scripts.test.ts

 _________________________________________
< Code review: now with 100% more rabbit. >
 -----------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-22T13:07:57Z

✅ Deterministic PR hygiene checks passed.

github-actions · 2026-09-22T13:21:09Z

⏳ DRAFT

wrong target branch (main); retarget to dev.

What to do

Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
Automatic draft conversion failed (token cannot change draft status). Please convert this pull request to a draft manually. The required enforce-target check will keep failing until every issue above is resolved.

…6711) * release: v2.33.0-preview.20260825 * release: v2.34.0-preview.20260827 * release: v2.36.0-preview.20260829 * fix(release): pass the bump job's permissions through the reusable-workflow call (#3262) Both v2.40.0 release dispatches (33615174183 preview, 33615177849 main) died at startup_failure: a workflow_call cannot grant its callee more than the calling job holds, and dev-version-bump.yml's job declares contents+pull- requests write. #3129 wired the call but never dispatched a release, so this is its first live run. The caller job now declares exactly the callee's two permissions; no other job in release.yml gains anything. Co-authored-by: jun <jun@lidge.dev> (cherry picked from commit 7ce0ba5) * release: set preview channel version 2.48.0-preview.20260908 * release: set main channel version 2.48.0 * chore(release): promote 2.55.0-preview.20260914 to preview Promotes the dev product snapshot 62f0222 to the preview train. The 2.55.0 line carries the #4546 cost-guard work: one send budget per logical request with a shared final-recovery reserve, zero-is-zero refusals with a typed error rather than a synthetic 502, compact and the Kiro inner retries admitted against that budget, a finite send ceiling per root workflow with an interactive reserve a fan-out cannot take, and a healthy detour promoted on transient-hold expiry instead of released cold. The previous preview tip 2.54.0-preview.20260914 is already tagged and published and is outranked by v2.54.0, so it could not be re-released; this is a new candidate rather than a re-cut. * chore(release): promote the verified 2.55.0 product tree to main Same product tree as preview 7bdd1b2 / 2.55.0-preview.20260914, which published successfully with its registry smoke green. Only package.json version differs. * ci(release): expose Linux bundler diagnostics for stable artifacts * fix(release): prepare stable platform bundles * fix(desktop): carry native sidecar packaging repair to main (#5532) * chore(ci): refresh main release verification (#5534) * fix(release): carry lipo argument fix to main (#5537) * fix(release): carry checksum and signature repair to main (#5546) * fix(release): carry Windows checksum record support to main (#5552) * fix(release): publish the GitHub release only after its verified assets attach (#5555) (#5558) GitHub freezes a release when it is published, so the attach step's upload came back HTTP 422 "Cannot upload assets to an immutable release". Every release from v2.55.0 to v2.60.0 therefore shipped with zero assets and the desktop updater had nothing to download. Create the release as a draft and flip it to published in attach-release, after the verified bundle is uploaded. Release notes still come from the validated notes file written at creation. * release: prepare 2.63.0 version metadata (#5612) * release: prepare 2.69.0 version metadata * fix(release): sign the packaged macOS keyring addons before notarization (#6271) * fix(release): sign the packaged macOS keyring addons before notarization Notarization rejected the 2.73.0 preview app: Resources/keyring/*.node, bundled since #6161, were unsigned or ad-hoc and had no secure timestamp, and Tauri does not sign files under Resources. Sign each darwin addon in place with the Developer ID identity, hardened runtime and timestamp after the certificate import and before tauri build, verify the result, and fail a real release that lacks signing material. * fix(release): match keyring signature fields without a pipe (cherry picked from commit 11782ee) * chore(release): 2.74.0 * fix: demote developer to user for OrcaSAQ-2 leading-system template The OrcaSAQ-2-Cyber-27B GGUF pins the same chat-template contract as Qwen3.8-27B — a non-leading `system` raises and `developer` is unsupported — so translated requests carrying a mid-conversation developer reminder failed upstream with a 500 template error. Widen the leading-system matcher to the OrcaSAQ family (org prefix optional, quant tag optional) so the reminder keeps its slot as `user`. --------- Co-authored-by: JUN <bitkyc08@gmail.com> Co-authored-by: jun <jun@junui-MacBookPro.local> Co-authored-by: jun <jun@lidge.dev> Co-authored-by: lidge-jun <243035832+lidge-jun@users.noreply.github.com> Co-authored-by: t <a@b.com> Co-authored-by: JUN <jun@lidgeai.com>

fix(release): carry Windows checksum record support to main

3a54428

lidge-jun requested a review from Ingwannu as a code owner September 22, 2026 13:05

lidge-jun merged commit f1b2180 into main Sep 22, 2026
16 of 17 checks passed

lidge-jun deleted the codex/main-checksum-marker branch September 22, 2026 13:05

github-actions Bot added the bug Something isn't working label Sep 22, 2026

github-actions Bot changed the title ~~release(main): carry Windows checksum record support~~ [WRONG BRANCH] release(main): carry Windows checksum record support Sep 22, 2026

Navigation Menu

Repository navigation

[WRONG BRANCH] release(main): carry Windows checksum record support - #5552

[WRONG BRANCH] release(main): carry Windows checksum record support#5552
lidge-jun merged 1 commit into
mainfrom
codex/main-checksum-marker

lidge-jun commented Sep 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 22, 2026

Uh oh!

coderabbitai Bot commented Sep 22, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lidge-jun commented Sep 22, 2026

Summary

Verification

Checklist

Uh oh!

chatgpt-codex-connector Bot commented Sep 22, 2026

Uh oh!

coderabbitai Bot commented Sep 22, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

github-actions Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ DRAFT

What to do

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Sep 22, 2026 •

edited

Loading