docs(apt): say plainly what [trusted=yes] gives up - #39
Merged
Conversation
The install instructions hand users a flag that disables apt's signature verification, next to a package that installs a root-invoked helper, with no indication that either fact is true. States what the flag does, offers the manual .deb path for anyone not willing to take that trade, and points at the signing doc. Also adds apt-signing to the Development sidebar -- it shipped in #35 but was reachable only by knowing the URL. These instructions revert to signed-by= automatically once a signing key is configured; the release workflow generates the page from whichever form it actually published.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
thinkutils | 9e60436 | Jul 20 2026, 03:23 AM |
This was referenced Jul 20, 2026
vietanhdev
added a commit
that referenced
this pull request
Jul 20, 2026
The concurrency block intended never to cancel on main -- the comment said
so -- and did the opposite:
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
The expression renders to the STRING "false", and a non-empty string is
truthy in that position, so main was cancelled like any other ref. It
failed silently for exactly as long as nobody merged twice in quick
succession.
Four main runs were cancelled during this batch of merges (#36, #37, #39,
#32), each with ZERO jobs recorded -- so those commits have no evidence
they ever built. The runs that were supposed to be the record of what
shipped are the ones that got killed.
Encoding the rule in the concurrency GROUP is unambiguous: on main the SHA
gives every run its own group, so there is nothing to supersede; every
other ref keeps a per-ref group, so a force-push still cancels the old run.
tests/workflow_concurrency.rs guards both halves -- an expression-valued
cancel-in-progress, and a group that lost its per-SHA component (which
with cancel-in-progress: true would cancel main on every push, strictly
worse than the bug it replaced). Mutation-verified: restoring the original
two lines fails both.
118 tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The download page hands users
[trusted=yes]— which disables apt's signature verification entirely — next to a package that installs a root-invoked fan helper, with no indication that either fact is true.Follow-up to #35, which added the signing machinery. Until a key is configured the repository really is unsigned, so the flag is still correct; it just shouldn't be silent.
.debpath for anyone unwilling to take that trade (giving up automatic updates)apt-signingto the Development sidebar — it shipped in security(apt): sign the published APT repository #35 but was reachable only by knowing the URLThe instructions revert to
signed-by=on their own once a key exists: the release workflow generates that page from whichever form it actually published, so there's no second place to remember to update.Docs build passes (vitepress fails on dead links, so the new sidebar link resolves).