Add digest field to versions API for updater digest checking - #194
Merged
Conversation
GitHub computes a SHA-256 digest for each release asset. Surface it as `digest` (sha256:<hex>, or null if GitHub hasn't computed one) on release objects returned by the versions/v1 API, so the FOSSBilling updater can verify downloaded update packages against it.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| 🔵 In progress View logs |
api | ac1ca97 | Commit Preview URL Branch Preview URL |
Aug 13 2026, 06:23 AM |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 6 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="src/services/versions/v1/interfaces.ts">
<violation number="1" location="src/services/versions/v1/interfaces.ts:12">
P2: When an existing `CACHE_KV` entry is served after deployment, the API omits `digest` instead of returning the declared `null` fallback, so digest-aware consumers cannot verify those releases until manual `/update` or cache expiry. Normalize legacy cached releases before returning them, or version and invalidate the cache.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Cache entries written before the digest field was introduced omit the key entirely rather than storing null. Since the code only cast the parsed JSON to Releases without normalizing, those legacy entries were served with digest absent instead of the documented null fallback, until a manual /update or the 24h cache TTL refreshed them. Normalize digest to null for any cached release missing it in parseCachedReleases, which both the cache-hit and stale-fallback paths go through.
Contributor
There was a problem hiding this comment.
No issues found across 7 files
Auto-approved: Adds a nullable 'digest' field to the versions API response—purely additive and non-breaking, surfaced from GitHub's existing SHA-256 data. Tests confirm both new and cache-normalized behavior.
Re-trigger cubic
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
digestfield to release objects returned by theversions/v1API, so the FOSSBilling updater can verify downloaded update packages via SHA-256 digest checking.GitHub already computes and returns a SHA-256 digest (
sha256:<hex>) for each release asset in its Releases API response, so this is just surfaced through — no new subrequest or hashing needed.digestisnullfor older assets predating GitHub's digest support.This is a purely additive, non-breaking change to the existing response shape.