From 479d4b535cafabe9d84845a8b991a2791f4eff67 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 28 Sep 2026 21:56:51 -0400 Subject: [PATCH 1/2] Name one reporting channel order in SECURITY.md, not two The private-reporting paragraph was added above the old email instruction, so the policy named security@simtabi.com twice and read as two competing instructions. Private reporting is the preferred channel and the address is its fallback; the rest of the section now applies to either. --- SECURITY.md | 1 - 1 file changed, 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 4882055..52740c4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,7 +4,6 @@ The preferred channel is GitHub private vulnerability reporting: open a private report at . The report stays attached to the repository, with a draft advisory and a CVE request path. Email **security@simtabi.com** if you do not use GitHub. -Please report security vulnerabilities privately to **security@simtabi.com**. Do **not** open a public issue for a security report. Include, where possible: a description of the issue, affected version(s), From fc077c613766316054f3a2d4bb777df89814533c Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Mon, 28 Sep 2026 22:12:27 -0400 Subject: [PATCH 2/2] Fall back to the releases/latest redirect when the API refuses The GitHub API allows 60 unauthenticated requests an hour per IP, so a shared NAT or a CI runner can find it spent: the macOS installer job failed twice in a row with curl exit 56 on a 403. The web redirect is not counted against that limit and names the same tag. Keeping the unauthenticated call first preserves the bash 3.2 empty-array path the job exists to exercise. --- src/scripts/install.sh | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/scripts/install.sh b/src/scripts/install.sh index 1c3fc4e..a22eebd 100755 --- a/src/scripts/install.sh +++ b/src/scripts/install.sh @@ -66,8 +66,16 @@ if [ -z "$VERSION" ]; then # into a failed install - intermittently, depending on whether curl had # finished writing. awk reads a here-string, so there is no pipeline left for # an early exit to break. - body="$(curl -fsSL ${auth[@]+"${auth[@]}"} -H 'Accept: application/vnd.github+json' "$api")" + body="$(curl -fsSL ${auth[@]+"${auth[@]}"} -H 'Accept: application/vnd.github+json' "$api" || true)" VERSION="$(awk -F'"' '/"tag_name"/{print $4; exit}' <<<"$body")" + # The API allows 60 unauthenticated requests an hour per IP, and anyone behind + # a shared NAT - or on a CI runner - can find that spent and get a 403. The + # releases/latest web redirect is not counted against it and names the same + # tag, so fall back to it rather than failing the install. + if [ -z "$VERSION" ]; then + latest="$(curl -fsSLI -o /dev/null -w '%{url_effective}' "https://github.com/${OWNER}/${REPO}/releases/latest" || true)" + case "$latest" in */tag/*) VERSION="${latest##*/tag/}" ;; esac + fi fi [ -n "$VERSION" ] || err "could not determine the version to install." case "$VERSION" in v*) ;; *) VERSION="v$VERSION" ;; esac