mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-17 21:29:10 +00:00
433036b978
The install script downloads cli.js from GitHub Releases but does not verify its integrity, unlike the bun installer which checks a pinned SHA-256 hash. This adds checksum verification using a companion cli.js.sha256 release artifact (same pattern as the bun hash check). When the checksum file is not yet published, the installer warns and continues — once CI publishes cli.js.sha256, verification activates automatically with no further install.sh changes needed. Fixes #3327 Agent: security-auditor Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| aws | ||
| cli | ||
| daytona | ||
| digitalocean | ||
| docker | ||
| e2e | ||
| gcp | ||
| hetzner | ||
| local | ||
| shared | ||
| sprite | ||
| test | ||