Skip to content

Name one reporting channel order in SECURITY.md; survive an API rate limit in install.sh #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imanimanyara merged 2 commits into from
Sep 29, 2026
Merged

Name one reporting channel order in SECURITY.md; survive an API rate limit in install.sh #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
479d4b5
Name one reporting channel order in SECURITY.md, not two
imanimanyara Sep 29, 2026
fc077c6
Fall back to the releases/latest redirect when the API refuses
imanimanyara Sep 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@

The preferred channel is GitHub private vulnerability reporting: open a private report at <https://github.com/simtabi/ssh-manager/security/advisories/new>. The report stays attached to the repository, with a draft advisory and a CVE request path. Email **security@simtabi.com** if you do not use GitHub.

Please report security vulnerabilities privately to **security@simtabi.com**.
Do **not** open a public issue for a security report.

Include, where possible: a description of the issue, affected version(s),
Expand Down
10 changes: 9 additions & 1 deletion src/scripts/install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,8 +66,16 @@ if [ -z "$VERSION" ]; then
# into a failed install - intermittently, depending on whether curl had
# finished writing. awk reads a here-string, so there is no pipeline left for
# an early exit to break.
body="$(curl -fsSL ${auth[@]+"${auth[@]}"} -H 'Accept: application/vnd.github+json' "$api")"
body="$(curl -fsSL ${auth[@]+"${auth[@]}"} -H 'Accept: application/vnd.github+json' "$api" || true)"
VERSION="$(awk -F'"' '/"tag_name"/{print $4; exit}' <<<"$body")"
# The API allows 60 unauthenticated requests an hour per IP, and anyone behind
# a shared NAT - or on a CI runner - can find that spent and get a 403. The
# releases/latest web redirect is not counted against it and names the same
# tag, so fall back to it rather than failing the install.
if [ -z "$VERSION" ]; then
latest="$(curl -fsSLI -o /dev/null -w '%{url_effective}' "https://github.com/${OWNER}/${REPO}/releases/latest" || true)"
case "$latest" in */tag/*) VERSION="${latest##*/tag/}" ;; esac
fi
fi
[ -n "$VERSION" ] || err "could not determine the version to install."
case "$VERSION" in v*) ;; *) VERSION="v$VERSION" ;; esac
Expand Down
Loading