Repository navigation
feat(install): add verified release wheel installer - #8
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Willay has published wheels but no documented one-line release installer. Add
curl .../install.sh | shfor hosts with Python 3.12+ and uv already installed. The installer selects a stable release, checks canonical wheel/checksum URLs and verifies the wheel before creating a new private version directory. It then checks the installed command version. The default install exposes a non-overwriting~/.local/bin/willaysymlink; a custom prefix remains isolated.Existing destinations, existing commands (including dangling symlinks), wrong release versions, foreign asset URLs and checksum mismatches are refused. A failed child or wrong installed version removes only the newly created version directory. Dry-run writes nothing and explicitly does not claim payload verification. No Python download, credentials, render, feed, service or shell-profile setup is performed.
Validation: full
just checkpasses (45 tests, Ruff format/lint and ty); wheel build and shell syntax pass. The two new default-command controls first failed against the retained candidate, then passed after linking the verified command and refusing existing command ownership. The retained terminal demo exercises the actual embedded installer with HTTP and uv mocked; it does not establish a real installed-wheel result. The new hosted workflow supplies the real published v0.1.0 wheel checks on Linux and both macOS runner architectures, including default command discovery and retained-destination refusal; those results are pending.Checksum verification trusts the publisher and HTTPS. Dependencies resolved from PyPI are outside the release wheel checksum. Source acceptance does not complete the wider public-installer census or packaging plan.
Hosted results retained: Linux published-wheel install and default command discovery passed at c482df2. The Intel macOS fixture failed because its test compared resolved
/private/varwith unresolved/var. The test-only repair now always exercises an aliased HOME locally and resolves both paths; that fixture first reproduced the failure on Linux, then the full 45-test/lint/type gate passed. Installer, workflow, documentation and ownership guards are unchanged by the repair. Fresh hosted CI at 9c9530f is pending; the old failure is preserved.