From d87c0855178db29b2830449789e2d7ff801a2e63 Mon Sep 17 00:00:00 2001 From: Tianzhou Date: Fri, 16 Oct 2026 00:52:31 +0800 Subject: [PATCH 1/2] feat: publish a sha256 checksums file with each release (#623) Add a "Generate checksums" step to the release job that hashes every downloaded artifact (binaries, .deb, .rpm) and writes pgschema--checksums.txt in sha256sum format, then attach it to the GitHub release. Version managers such as proto can point at it to verify prebuilt binaries. Document how to verify a download in docs/installation.mdx, and fix the Linux pre-built binary URLs there, which omitted the version from the asset name. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release.yml | 10 ++++++++++ docs/installation.mdx | 26 ++++++++++++++++++++++++-- 2 files changed, 34 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 48b80bd10..7e16bc5c3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -176,6 +176,15 @@ jobs: with: path: binaries + # Each artifact is downloaded into binaries//, so */* + # covers every binary, .deb and .rpm. The sed strips the directory prefix so + # each line is " ", the format `sha256sum -c` expects. + - name: Generate checksums + working-directory: binaries + run: | + sha256sum */* | sed -E 's# .*/# #' > "pgschema-${{ steps.version.outputs.version }}-checksums.txt" + cat "pgschema-${{ steps.version.outputs.version }}-checksums.txt" + - name: Create release uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 with: @@ -192,6 +201,7 @@ jobs: binaries/pgschema-deb-arm64/*.deb binaries/pgschema-rpm-amd64/*.rpm binaries/pgschema-rpm-arm64/*.rpm + binaries/pgschema-${{ steps.version.outputs.version }}-checksums.txt docker: needs: [build-binaries, packages] diff --git a/docs/installation.mdx b/docs/installation.mdx index 20d6ad61f..a0ad58649 100644 --- a/docs/installation.mdx +++ b/docs/installation.mdx @@ -139,7 +139,7 @@ Replace `v1.0.0` with the [latest release version](https://github.com/pgplex/pgs ```bash # Download the binary - curl -L https://github.com/pgplex/pgschema/releases/download/v1.0.0/pgschema-linux-amd64 -o pgschema + curl -L https://github.com/pgplex/pgschema/releases/download/v1.0.0/pgschema-1.0.0-linux-amd64 -o pgschema # Make it executable chmod +x pgschema @@ -155,7 +155,7 @@ Replace `v1.0.0` with the [latest release version](https://github.com/pgplex/pgs ```bash # Download the binary - curl -L https://github.com/pgplex/pgschema/releases/download/v1.0.0/pgschema-linux-arm64 -o pgschema + curl -L https://github.com/pgplex/pgschema/releases/download/v1.0.0/pgschema-1.0.0-linux-arm64 -o pgschema # Make it executable chmod +x pgschema @@ -169,6 +169,28 @@ Replace `v1.0.0` with the [latest release version](https://github.com/pgplex/pgs +## Verify Downloads + +Each release includes a `pgschema--checksums.txt` file with the SHA-256 checksum of every binary, DEB, and RPM asset. Download it next to the asset and verify before installing. + + +Replace `v1.0.0` and `1.0.0` with the [latest release version](https://github.com/pgplex/pgschema/releases). Keep the original asset file name when downloading so it matches the checksums file. + + +```bash +# Download an asset and the checksums file +curl -LO https://github.com/pgplex/pgschema/releases/download/v1.0.0/pgschema-1.0.0-linux-amd64 +curl -LO https://github.com/pgplex/pgschema/releases/download/v1.0.0/pgschema-1.0.0-checksums.txt + +# Verify on Linux +sha256sum -c --ignore-missing pgschema-1.0.0-checksums.txt + +# Verify on macOS +shasum -a 256 -c --ignore-missing pgschema-1.0.0-checksums.txt +``` + +`--ignore-missing` skips assets you did not download. A successful check prints `OK` for each downloaded asset; a mismatch prints `FAILED` and exits non-zero. + ## Docker Run pgschema using Docker without installing it locally: From 783e96b18aefcb71e842d0c6da9e63de7a5a2541 Mon Sep 17 00:00:00 2001 From: Tianzhou Date: Fri, 16 Oct 2026 01:01:04 +0800 Subject: [PATCH 2/2] docs: note both version placeholders for pre-built binary downloads Co-Authored-By: Claude Fable 5.1 --- docs/installation.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/installation.mdx b/docs/installation.mdx index a0ad58649..3c001eff0 100644 --- a/docs/installation.mdx +++ b/docs/installation.mdx @@ -36,7 +36,7 @@ Windows is not supported. Please use WSL (Windows Subsystem for Linux) or a Linu Download and install the pre-built binary for macOS. - Replace `v1.0.0` with the [latest release version](https://github.com/pgplex/pgschema/releases). + Replace `v1.0.0` and `1.0.0` with the [latest release version](https://github.com/pgplex/pgschema/releases). ```bash @@ -132,7 +132,7 @@ Replace `v1.0.0` and `1.0.0` with the [latest release version](https://github.co For Linux systems without package manager support, download pre-built binaries from the [GitHub releases page](https://github.com/pgplex/pgschema/releases). -Replace `v1.0.0` with the [latest release version](https://github.com/pgplex/pgschema/releases). +Replace `v1.0.0` and `1.0.0` with the [latest release version](https://github.com/pgplex/pgschema/releases).