From 9b12fd58401c9118ca24c6de5d79076455d5ad93 Mon Sep 17 00:00:00 2001
From: Benjamin Sherman <benjamin@holyarmy.org>
Date: Thu, 24 Aug 2023 12:18:33 -0500
Subject: [PATCH] fix: use raw output from jq to install cosign again (#312)

---
 build.sh                  | 2 +-
 github-release-install.sh | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/build.sh b/build.sh
index ad89bf98..b7e527be 100755
--- a/build.sh
+++ b/build.sh
@@ -58,4 +58,4 @@ else
 fi
 
 ## install packages direct from github
-/tmp/github-release-install.sh sigstore/cosign x86_64.rpm
+/tmp/github-release-install.sh sigstore/cosign x86_64
diff --git a/github-release-install.sh b/github-release-install.sh
index 5fca5966..9beedfe8 100755
--- a/github-release-install.sh
+++ b/github-release-install.sh
@@ -32,14 +32,17 @@ if [ -z ${ARCH_FILTER} ]; then
   exit 2
 fi
 
+set -ouex pipefail
+
 API="https://api.github.com/repos/${ORG_PROJ}/releases/latest"
 RPM_URLS=$(curl -sL ${API} \
   | jq \
+    -r \
     --arg arch_filter "${ARCH_FILTER}" \
     '.assets | sort_by(.created_at) | reverse | .[] | select(.name|test($arch_filter)) | select (.name|test("rpm$")) | .browser_download_url')
 for URL in ${RPM_URLS}; do
   # WARNING: in case of multiple matches, this only installs the first matched release
-  echo "execute: rpm-ostree install ${URL}"
-  rpm-ostree install ${URL}
+  echo "execute: rpm-ostree install \"${URL}\""
+  rpm-ostree install "${URL}"
   break
 done