nandi/cosmicnim · 8dafda6

⑂ 8dafda6

Fetch releases anonymously from the right host

Assets are served from rickub.com, not git.rickub.com (which is git
smart-HTTP only and 405s on a plain GET). The repo is public now, so the
Bearer token is gone from both fetch recipes.

Verified end to end: `just fetch` resolves v0.1.2, checks the published
sha256 and installs the library.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nandithebull committed 2026-09-20T10:25:14-07:00 Browse files

8dafda6 parent: e289b31

modified README.md +2 -3 Viewed

@@ -61,9 +61,8 @@ proc onView(ctx: pointer; b: Builder) {.cdecl.} =
61	61	The demo needs `nim/libcosmic_ffi.so`. Take it from a release:
62	62
63	63	```bash
64		-export RICKUB_TOKEN=... # the repo is private
65		-just fetch # newest v* tag on the remote
66		-just fetch v0.1.2 # or a specific one
	64	+just fetch # newest v* tag on the remote
	65	+just fetch v0.1.2 # or a specific one
67	66	just run
68	67	```
69	68

  The demo needs `nim/libcosmic_ffi.so`. Take it from a release:
  ```bash
--export RICKUB_TOKEN=...   # the repo is private
++just fetch          # newest v* tag on the remote
--just fetch                # newest v* tag on the remote
++just fetch v0.1.2   # or a specific one
--just fetch v0.1.2         # or a specific one
  just run
  ```

modified justfile +4 -7 Viewed

@@ -2,7 +2,7 @@
2	2
3	3	so := "nim/libcosmic_ffi.so"
4	4	export REMOTE := "rickub"
5		-export BASE_URL := "https://git.rickub.com/nandi/cosmicnim"
	5	+export BASE_URL := "https://rickub.com/nandi/cosmicnim"
6	6	export TARGET := "x86_64-unknown-linux-gnu"
7	7
8	8	default: run
@@ -31,7 +31,6 @@ fmt:
31	31	fetch tag="":
32	32	#!/usr/bin/env bash
33	33	set -euo pipefail
34		- : "${RICKUB_TOKEN:?export RICKUB_TOKEN with a token that can read releases}"
35	34	tag="{{tag}}"
36	35	if [ -z "$tag" ]; then
37	36	# The remote is the source of truth; local tags may be stale or absent.
@@ -42,17 +41,15 @@ fetch tag="":
42	41	fi
43	42	just fetch-url "$BASE_URL/releases/download/$tag/cosmic_ffi-$tag-$TARGET.tar.gz"
44	43
45		-# Install the .so from an explicit asset URL (needs $RICKUB_TOKEN).
	44	+# Install the .so from an explicit asset URL.
46	45	fetch-url url:
47	46	#!/usr/bin/env bash
48	47	set -euo pipefail
49		- : "${RICKUB_TOKEN:?export RICKUB_TOKEN with a token that can read releases}"
50	48	tmp=$(mktemp -d)
51	49	trap 'rm -rf "$tmp"' EXIT
52		- auth=(-H "Authorization: Bearer $RICKUB_TOKEN")
53		- curl -fsSL "${auth[@]}" -o "$tmp/asset.tar.gz" "{{url}}"
	50	+ curl -fsSL -o "$tmp/asset.tar.gz" "{{url}}"
54	51	# The workflow publishes a checksum beside every tarball; use it if it is there.
55		- if curl -fsSL "${auth[@]}" -o "$tmp/asset.sha256" "{{url}}.sha256" 2>/dev/null; then
	52	+ if curl -fsSL -o "$tmp/asset.sha256" "{{url}}.sha256" 2>/dev/null; then
56	53	(cd "$tmp" && sed "s\| .*\| asset.tar.gz\|" asset.sha256 \| sha256sum -c -)
57	54	else
58	55	echo "no .sha256 alongside the asset; skipping checksum" >&2

  so := "nim/libcosmic_ffi.so"
  export REMOTE := "rickub"
--export BASE_URL := "https://git.rickub.com/nandi/cosmicnim"
++export BASE_URL := "https://rickub.com/nandi/cosmicnim"
  export TARGET := "x86_64-unknown-linux-gnu"
  default: run
  fetch tag="":
      #!/usr/bin/env bash
      set -euo pipefail
--    : "${RICKUB_TOKEN:?export RICKUB_TOKEN with a token that can read releases}"
      tag="{{tag}}"
      if [ -z "$tag" ]; then
          # The remote is the source of truth; local tags may be stale or absent.
      fi
      just fetch-url "$BASE_URL/releases/download/$tag/cosmic_ffi-$tag-$TARGET.tar.gz"
--# Install the .so from an explicit asset URL (needs $RICKUB_TOKEN).
++# Install the .so from an explicit asset URL.
  fetch-url url:
      #!/usr/bin/env bash
      set -euo pipefail
--    : "${RICKUB_TOKEN:?export RICKUB_TOKEN with a token that can read releases}"
      tmp=$(mktemp -d)
      trap 'rm -rf "$tmp"' EXIT
--    auth=(-H "Authorization: Bearer $RICKUB_TOKEN")
++    curl -fsSL -o "$tmp/asset.tar.gz" "{{url}}"
--    curl -fsSL "${auth[@]}" -o "$tmp/asset.tar.gz" "{{url}}"
      # The workflow publishes a checksum beside every tarball; use it if it is there.
--    if curl -fsSL "${auth[@]}" -o "$tmp/asset.sha256" "{{url}}.sha256" 2>/dev/null; then
++    if curl -fsSL -o "$tmp/asset.sha256" "{{url}}.sha256" 2>/dev/null; then
          (cd "$tmp" && sed "s|  .*|  asset.tar.gz|" asset.sha256 | sha256sum -c -)
      else
          echo "no .sha256 alongside the asset; skipping checksum" >&2