jpmschweitzerandClaude Opus 4.8
89b7f99a8d
D-59 requires tracking dugite-native (bundled git) releases for security updates, but it lived only in the D-record prose with no mechanism (clean-house flagged RULE-SUNSET-WITHOUT-TICKET). Add ci/check_dugite_version.sh + a `make dugite-check` target: compares the Makefile DUGITE_VERSION pin against the latest desktop/dugite-native release and loudly flags CVE / security mentions in the notes. Informational (not a push gate) — the bump itself is manual per D-63 and automated by T-25. The script header is the maintenance home (dugite is fetched, not built, and native/dugite/ is gitignored, so there's no BUILD.md to record it): cadence (quarterly / on a git CVE), advisory subscriptions, and the bump procedure. D-59's cost line + a Makefile comment now point at the mechanism. T-88 stays open as the recurring calendar; first check (2026-06-28) shows v2.53.0-3 current. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
2.7 KiB
Bash
Executable File
53 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# T-88 — track dugite-native (bundled git) upstream releases for security
|
|
# updates (D-59). Compares the pinned DUGITE_VERSION against the latest
|
|
# desktop/dugite-native release and flags CVE / security mentions.
|
|
#
|
|
# WHY THIS SCRIPT IS THE MAINTENANCE HOME: dugite's binary is FETCHED at build
|
|
# time (`make dugite-fetch`), not built, and native/dugite/ is gitignored — so
|
|
# there is no `native/dugite/BUILD.md` (D-63) to record it. The pin lives in the
|
|
# Makefile (DUGITE_VERSION / DUGITE_COMMIT); this script + its `make dugite-check`
|
|
# target are the version-tracking calendar D-59 requires.
|
|
#
|
|
# CADENCE: run quarterly during normal operation. Run IMMEDIATELY on a git or
|
|
# dugite-native security advisory — subscribe to:
|
|
# https://github.com/git/git/security/advisories
|
|
# https://github.com/desktop/dugite-native/security/advisories
|
|
#
|
|
# This check is INFORMATIONAL (not a push gate): it reports drift and flags CVE
|
|
# mentions. The bump itself is manual per D-63 (reproducibility record) and is
|
|
# automated by T-25 (CI). A bump updates: Makefile DUGITE_VERSION/COMMIT, the
|
|
# fetched binary in native/dugite/, and assets/licenses.yaml if the bundled git
|
|
# or dugite version changed.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
REPO="desktop/dugite-native"
|
|
CURRENT="$(grep -E '^DUGITE_VERSION[[:space:]]*:=' Makefile | head -1 | sed -E 's/.*:=[[:space:]]*//')"
|
|
|
|
# Public read — no auth needed for a quarterly check. gh would raise the rate
|
|
# limit but isn't required; curl keeps this dependency-free.
|
|
json="$(curl -fsSL -H 'Accept: application/vnd.github+json' "https://api.github.com/repos/$REPO/releases/latest" 2>/dev/null || true)"
|
|
LATEST="$(printf '%s' "$json" | sed -nE 's/.*"tag_name":[[:space:]]*"([^"]+)".*/\1/p' | head -1)"
|
|
|
|
if [[ -z "$LATEST" ]]; then
|
|
echo "==> dugite-check: couldn't reach the dugite-native releases API." >&2
|
|
echo " Check manually: https://github.com/$REPO/releases" >&2
|
|
exit 2
|
|
fi
|
|
|
|
echo "==> dugite-check (T-88): bundled '$CURRENT' vs latest release '$LATEST'"
|
|
if [[ "$CURRENT" == "$LATEST" ]]; then
|
|
echo " OK — up to date."
|
|
else
|
|
echo " DRIFT — a newer dugite-native release exists: $CURRENT -> $LATEST"
|
|
echo " Bump (D-63 record; machine: T-25): update Makefile DUGITE_VERSION/COMMIT,"
|
|
echo " refresh native/dugite/, and assets/licenses.yaml if the git/dugite version changed."
|
|
fi
|
|
|
|
# Loud flag when the latest release notes mention a CVE / security fix — those
|
|
# jump the queue regardless of the quarterly cadence.
|
|
if printf '%s' "$json" | grep -qiE 'cve-[0-9]{4}|security (fix|advisory|release|update)|vulnerab'; then
|
|
echo " !! SECURITY: the latest release notes mention a CVE / security fix — schedule a bump NOW." >&2
|
|
fi
|