fix: populate real sha512 hashes for v4.0.0 stable in wheels.json - #3
Merged
Conversation
The stable bucket/wheels.json shipped with zero-filled sha512 placeholders for wheels-module-4.0.0.zip and wheels-core-4.0.0.zip. The manifest comment said the autoupdate path would populate them after GA, but the bucket has no autoupdate workflow and isn't registered with Excavator, so the zeros persisted six days post-GA. Result: every `scoop install wheels` from a fresh shell failed with "Hash check failed!" — confirmed by two user reports (Michael internal, zainforbjs in #2) and reported via wheels-dev/wheels#2758. Real hashes pulled from the corresponding .sha512 sidecars on the v4.0.0 GitHub Release and pasted in. Follow-ups in wheels-dev/wheels: - release.yml emits wheels-core-X.X.X.sha512 (no .zip segment) while the autoupdate config expects wheels-core-X.X.X.zip.sha512. Even with auto wired up, the core hash would 404. Fixing in a separate PR. - Decide between Excavator registration vs self-hosted autoupdate cron. Refs wheels-dev/wheels#2758 Closes #2 Signed-off-by: Peter Amiri <peter@alurium.com>
8 tasks
bpamiri
added a commit
that referenced
this pull request
May 18, 2026
feat: inline OpenJDK 21 + self-hosted autoupdate workflow (supersedes #3)
bpamiri
added a commit
to wheels-dev/wheels
that referenced
this pull request
May 18, 2026
…#2758) (#2761) * fix(release): emit .zip.{sha512,md5} sidecars + add Scoop install gotchas to docs Three converging fixes that together close out the user-visible install breakage reported in #2758 (and by two additional users on the scoop-wheels side: zainforbjs#2 and a private report from Michael at PAI). ### 1. release: emit `*.zip.sha512` / `*.zip.md5` instead of `*.sha512` / `*.md5` The scoop-wheels bucket's `autoupdate` config substitutes `$url.sha512` to locate each artifact's checksum sidecar — i.e. for `wheels-core-X.X.X.zip` it looks for `wheels-core-X.X.X.zip.sha512`. The build scripts were emitting `wheels-core-X.X.X.sha512` (no `.zip.` segment), so even if Excavator (or any other autoupdate path) ran post-GA it would 404 on every non-module artifact. wheels-module already used the correct `.zip.sha512` shape; the four other build scripts didn't. Touched: - `tools/build/scripts/build-{base,cli,core,starterApp}.sh`: emit `<artifact>.zip.{md5,sha512}` (was `<artifact>.{md5,sha512}`). - `tools/build/scripts/README.md`: documents the new filename shape. - `.github/workflows/release.yml` + `release-candidate.yml`: update the `actions/upload-artifact` glob patterns to match — 40 line edits across the two files. No consumers grep for the old shape (verified across homebrew-wheels, scoop-wheels, .deb/.rpm builders, framework code). snapshot.yml inherits via `uses: ./.github/workflows/release.yml`. ### 2. docs: add missing `scoop bucket add java` step `scoop install wheels` declares `java/openjdk21` as a dependency but Scoop does not auto-add the `java` bucket on the user's behalf — both real-user reports (Michael, zainforbjs) hit the same "Couldn't find manifest for 'openjdk21' from 'java' bucket" warning before being able to proceed. The docs claimed it was automatic. Updated: - `start-here/installing.mdx` Windows tab (both v4-0-0 and v4-0-1-snapshot) - `command-line-tools/installation.mdx` (both v4-0-0 and v4-0-1-snapshot) ### 3. docs: document `lucli modules install --url=` for standalone-LuCLI users New "Advanced: existing LuCLI install" section under "Manual JAR install" in `command-line-tools/installation.mdx` (both versions). Covers stable and bleeding-edge URLs, and an Aside enumerates what the user gives up vs. the Scoop/Homebrew/.deb/.rpm paths: binary name, LUCLI_HOME isolation, JDK resolution, SQLite shim, channel awareness, upgrade story. Triggered by Jay Dee's report (#2758) of trying `lucli modules install wheels@be` based on inferred channel naming — the `@be` tag doesn't exist in LuCLI's registry, and the bare `wheels` entry points at a stale `wheels-cli-lucli` mirror that hasn't been synced from develop since 2026-04-04. ### Not in this PR (deliberate scope split) - Real sha512 hashes for v4.0.0 in `scoop-wheels/bucket/wheels.json` — that lives in a different repo. Already up as wheels-dev/scoop-wheels#3 and unblocks the immediate install failure. - Deciding whether to register scoop-wheels with Excavator or self-host a cron-driven autoupdate workflow — needs a design call, follow-up after the immediate-fix PRs land. - Updating LuCLI's bundled registry (`local.json:23`) to point at `wheels-dev/wheels` directly instead of the stale `wheels-cli-lucli` mirror — needs Mark's input on the LuCLI side. Refs #2758 Refs wheels-dev/scoop-wheels#2 Signed-off-by: Peter Amiri <peter@alurium.com> * docs: address Reviewer A/B consensus findings (round 1) - README at tools/build/scripts/: add build-starterApp.sh to the scripts list and add wheels-starter-app artifact entries to the output-structure diagram (header text bumped from "three" to "four" Wheels variants). - installation.mdx (v4-0-0 + v4-0-1-snapshot): replace the fragile curl | sed pipeline in the new "Advanced: existing LuCLI install" section with jq, and add an empty-tag guard so an API failure or rate-limit miss fails fast with a useful message instead of silently 404-ing on a malformed URL. - CHANGELOG.md: add ### Fixed entries under [Unreleased] for the .zip.{sha512,md5} sidecar rename and the Windows scoop bucket add java prerequisite. - PR description: add a manual smoke-test checkbox covering the bleeding-edge lucli modules install --url= snippet. Signed-off-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> * ci: dispatch scoop-wheels, retire chocolatey The downstream package-manager dispatch step has fired wheels-released events to wheels-dev/homebrew-wheels and wheels-dev/chocolatey-wheels. Swap chocolatey out for scoop-wheels — the v1.x chocolatey-wheels package is CommandBox-based and can't drive v4, so the Windows install path moved permanently to Scoop in 4.0. scoop-wheels#4 adds the autoupdate workflow on the consumer side that listens for this dispatch event. Touches the dispatch loop, the secret docstring, the in-step warning message, and the three sibling comments (apt/yum dispatch + bump-develop) that referenced the homebrew/chocolatey step as their channel-derivation template. No functional change for stable v4.0.0 (it already shipped). Takes effect on the next snapshot or 4.0.1 release. Refs #2758 Refs wheels-dev/scoop-wheels#4 Signed-off-by: Peter Amiri <peter@alurium.com> * docs: address Reviewer A/B consensus findings (round 2) - tools/build/scripts/README.md:36 — "three variants" to "four variants" in the Convenience Scripts section (line 3 was fixed in round 1; line 36 was missed). - web/sites/guides/src/content/docs/v4-0-0/command-line-tools/installation.mdx (lines 76-77, 84-85) and the matching v4-0-1-snapshot mirror — replace the `sed -nE` tag-resolver in the bleeding-edge deb/rpm snippets with `jq -r '.[0].tag_name | sub("^v"; "")'` plus the same empty-tag guard added to the LuCLI section in round 1. Both items map to Reviewer B's converged-changes verdict on SHA a81345a; Reviewer A's review of the round-1 commit (`a81345ae`) and the round-2 commit (`5144fdbb`) flagged the same carry-overs. Refs #2758 Signed-off-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> * docs: address Reviewer A/B consensus findings (round 3) - Replace remaining `curl | sed -nE` pipelines in the stable Linux `.deb`/`.rpm` install snippets (lines 60 and 67 in both `v4-0-0/command-line-tools/installation.mdx` and `v4-0-1-snapshot/command-line-tools/installation.mdx`) with the same `jq -r '.tag_name | sub("^v"; "")'` pattern plus empty-tag guard that round 1 applied to the LuCLI section and round 2 applied to the bleeding-edge `.deb`/`.rpm` snippets. The two parallel snippet pairs in each file (stable + bleeding-edge) now use the same resolver and error-handling path. Reviewer B's round-1 converged-changes on SHA `5144fdbb9` also listed amending the type of commit `5144fdbb9` from `release:` to `ci:` to satisfy commitlint. That requires rewriting published git history, which is outside the bot's allowed git operations (read-only `git` per `_shared-rails.md`). It is left for a human to amend, squash-merge with a conforming subject, or override the DCO/commitlint check at merge time. Refs PR #2761. Signed-off-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> --------- Signed-off-by: Peter Amiri <peter@alurium.com> Signed-off-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bucket/wheels.jsonshipped with zero-filled sha512 placeholders for the two wheels-side archives. The manifest comment promised Scoop's autoupdate would fill them in after the first GA tag, but this bucket has no.github/workflows/and isn't registered with Excavator, so the zeros persisted six days post-GA.scoop install wheelsfrom a fresh shell hitsHash check failed!— two confirmed user reports (one internal, one in #2) and the parent thread at wheels-dev/wheels#2758..sha512sidecars on the v4.0.0 GitHub Release.Verification
Test plan
scoop bucket add java; scoop bucket add wheels https://github.com/wheels-dev/scoop-wheels; scoop install wheelssucceeds without "Hash check failed!"wheels --versionreports4.0.0 (stable)after installFollow-ups in wheels-dev/wheels (separate PR)
release.ymlemitswheels-core-X.X.X.sha512(no.zip.segment) — the autoupdate config expectswheels-core-X.X.X.zip.sha512, so even with autoupdate wired up the core hash would 404. Same shape mismatch on the other non-module artifacts.scoop bucket add javaprerequisite to the Windows install docs — Scoop'sdepends: java/openjdk21does not auto-add the dependency bucket.lucli modules install wheels --force --url=…as an advanced path for users who already have standalone LuCLI installed.Follow-ups in this repo (no PR yet — needs design call)
autoupdate.ymlcron under.github/workflows/. Excavator is set-and-forget but adds a community dependency; a self-hosted workflow keeps the publish path under our control.Refs wheels-dev/wheels#2758
Closes #2