a sl0p.foo repository https://git.sl0p.foo/sl0ppi.git/atom/site?h=main 2026-08-12T21:12:23Z 2026-08-12T21:12:23Z user user@clank 2026-08-12T21:12:23Z urn:sha1:4e647e2173a9817a2250666f8298b3b05d13ece5 Phase 5, settled as build scripts rather than CI: make release tests, then a fresh static-musl tarball make publish render the site, upload, and verify against the live URL publish.sh is deliberately dumb -- rsync, then ask the live site whether it agrees (status codes plus a re-downloaded checksum) -- but it has two guard rails that matter: - it refuses to republish a version whose bytes differ from what is already live. /releases/ is cached for a year, so the same URL serving two different tarballs would be undebuggable. Bump VERSION instead. - artifacts upload before latest.json, so the pointer never names a file that is not downloadable yet. site/install.sh is POSIX sh and short on purpose, because people are being asked to pipe it into a shell. It reads latest.json, downloads the versioned artifact, VERIFIES ITS SHA256, and only then unpacks and runs the bundled installer. Refusal was tested for real by serving a doctored latest.json: it stops with a checksum mismatch and installs nothing. Verified end to end from the public URL, in a throwaway HOME with node, npm, bun, cargo and rustc replaced by poison stubs: curl -fsSL https://sl0ppi.sl0p.foo/install.sh | sh sl0ppij --version -> 0.45.0+sl0p1 pi --version -> 0.84.1 sl0ppi doctor -> all good The vhost itself is committed in the sl0pday repo, where that box's nginx config lives.