From 543e5e54317c23ce8e5e20929585121146043f3f Mon Sep 17 00:00:00 2001 From: Thijs Date: Tue, 9 Jun 2026 20:32:38 +0200 Subject: [PATCH] chore(update): drop no-op checksum sed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The checksum verification piped the .sha256 through `sed "s/${tarball}$/${tarball}/"` before `sha256sum -c`. That substitution replaces the filename with itself, so it never changes anything — the accompanying comment ("rewrite it") describes behavior the code doesn't have. The release checksum is generated by `.releaserc.yml` with `sha256sum "towel-.tar.gz"`, which writes a bare filename in the standard two-space format. Since the tarball is downloaded under that same bare name into $tmpdir and verification runs from there, `sha256sum -c "$checksum"` matches the local file directly. Remove the no-op sed and its misleading comment, verifying the downloaded tarball directly. No behavior change; less dead code. --- user/local/share/towel/bin/towel-update | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/user/local/share/towel/bin/towel-update b/user/local/share/towel/bin/towel-update index ae5d0ae..b6f0b9f 100755 --- a/user/local/share/towel/bin/towel-update +++ b/user/local/share/towel/bin/towel-update @@ -187,8 +187,7 @@ echo "Downloading $tarball..." echo "Verifying checksum..." ( cd "$tmpdir" - # sha256sum -c expects the filename column to match the local file; rewrite it. - sed "s/${tarball}$/${tarball}/" "$checksum" | /usr/bin/sha256sum -c - >/dev/null 2>&1 + /usr/bin/sha256sum -c "$checksum" >/dev/null 2>&1 ) || { echo 1>&2 "towel update --apply failed: sha256 checksum mismatch — download may be corrupt" exit 1