mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-04-28 03:49:31 +00:00
7444c3bbc6
Why: The curl|bash pattern for bun installation was an unverified supply chain dependency. Now the installer is downloaded to a temp file and its SHA-256 hash is verified against a known-good value before execution. Falls back gracefully if sha256sum/shasum is unavailable. Agent: security-auditor Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| aws | ||
| cli | ||
| digitalocean | ||
| docker | ||
| e2e | ||
| gcp | ||
| hetzner | ||
| local | ||
| shared | ||
| sprite | ||
| test | ||