release-train: develop -> staging - #614
Merged
Merged
Conversation
… name (backend#2895) (#612)
#611) cosign writes "Verified OK" to STDERR on the SUCCESS path. Windows PowerShell 5.1 turns native-command stderr into a NativeCommandError record, and this installer runs under `$ErrorActionPreference = 'Stop'` (line 27), so that record is TERMINATING -- the install dies at the exact moment verification passes. `2>$null` does not save it: 5.1 raises the record before the redirection applies. Measured on a real Windows 11 box against the published v0.10.17 installer: Verifying cosign signature... cosign.exe : Verified OK + & $cosign verify-blob ` + FullyQualifiedErrorId : NativeCommandError ...and nothing was installed. So `tracebloc` cannot currently be installed on Windows at all. It also takes tracebloc/client's installer with it: Step 4 fails, which drops Step 5 to manual sign-in and Step 6 to the hand-typed credential prompt -- observed on the same machine. INVISIBLE ON POWERSHELL 7, which is why it survived: pwsh 7 does not make error records out of native stderr, so this passes wherever it is tested and fails on the Windows default. Verified both ways here. THIS FILE ALREADY HELD THE FIX, 230 LINES UP. `Test-CosignRuns` opens exactly this `$ErrorActionPreference = 'Continue'` window for `cosign version` and explains why. The idiom was simply never applied to the call that matters. Not piped to Out-Null: `$LASTEXITCODE` is the entire verdict here and piping a native command through a cmdlet is a documented way to lose it. The window makes the record non-terminating; `2>$null` still discards the text, so a real verification failure is unchanged -- it still exits 1. Fixes the CLASS, not the instance: install-ps1-verify.sh now asserts that every `& $...` invocation sits inside an ErrorActionPreference window (2 calls, 2 windows), with a vacuity floor so it cannot pass by finding none. Confirmed it reddens when the window is removed. scripts/tests/install-ps1-verify.sh: 11 passed. shellcheck clean. (The one behavioural-tier failure is pre-existing and environmental -- it finds a real cosign on this machine's PATH; identical on an unmodified tree.) Co-authored-by: shujaat hasan <shujaathasan@shujaats-MacBook-Pro.local> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 9a361d5. Configure here.
…kend#2790) (#615) The 2026-08-31 staging settle refused cli: rc NOT tagged - v0.10.18 already exists and the delta DOES touch published files (bump VERSION on develop before the next release) v0.10.18 is tagged and the staging->develop delta touches `internal/*` and `scripts/install.ps1`, both declared publish paths. Re-tagging would make one tag name two different trees. PATCH, measured. Two commits, both `fix`: fix(ingest): report the physical destination table, not the requested name fix(install): a VERIFIED signature no longer kills the Windows install (#611) No feat, nothing breaking, so 0.10.18 -> 0.10.19. FIFTH INSTANCE OF THIS TODAY, and the count is the point. design-system-v2 hit it twice (v0.1.0, v0.1.1) and this is cli's turn; a fourth apparent case on design-system-v2 today turned out to be a STALE MIRROR rather than a missing bump, which is its own argument for automating the distinction instead of eyeballing it. Every release needs the bump the NEXT release is refused without, and doing it by hand means a refused settle is how we find out. `.github#372` builds `post-release-bump.yml` for exactly this. This repo needs its caller; that is the third checkbox on backend#2790. Part of tracebloc/backend#2790
Contributor
Author
|
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 306389b. Configure here.
tracebloc-release-train
Bot
added
gate-nudge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-stagingbranch (a mirror ofdevelop), so it never collides with a human PR. Merged only when the fr-gate is green.Note
Medium Risk
Changes machine-readable ingest output and Windows install success path; behavior is intentional but scripts or CI that assumed the old table name or only tested pwsh 7 could be affected.
Overview
Release train bumps 0.10.18 → 0.10.19 with two user-facing fixes.
Ingest
--output-json(backend#2895): When the cluster uses per-ingestion physical tables (ds_<hex>), JSON and the human summary no longer echo the operator’s--namelabel. The CLI parsesDestination table:from the ingestor banner intosubmit.Summary.DestinationTable, prefers it inwritePushJSON’s"table"field, and shows it in the ingestion summary panel—with fallback to the requested name when the ingestor is older or the summary is missing (including nil summary on error paths).Windows
install.ps1: Wrapscosign verify-blobin the same$ErrorActionPreference = 'Continue'window already used forcosign version, so PowerShell 5.1 does not treat cosign’s success stderr (Verified OK) as a terminating error and abort a passing verification.install-ps1-verify.shadds a guard that native& $…invocations have at least as many Continue windows as calls.Reviewed by Cursor Bugbot for commit 306389b. Bugbot is set up for automated code reviews on this repo. Configure here.