- Fix return value leakage in install-core.ps1 (suppressed with $null)
- Fix ACL -bor compatibility across PowerShell versions
- Handle unsigned/lightweight git tags in GPG verification
- Skip GPG verification for branch builds (main)
- Add explicit GOOS=windows for Go build
- Detect Windows syscall build errors with helpful message
- Add clone-repos.ps1 as Windows alternative to `core setup`
- Update CLAUDE.md with Windows-specific setup instructions
Closes#56 workaround documented
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Host UK CIC mission: aggregate free tier compute to benefit OSS commons
Added:
- CONTRIBUTING.md: 5-minute contributor onboarding guide
- scripts/contribute.sh: One-command setup for new contributors
- Updated free-tier-services.md: Mission context, economics explained
The model:
- 100 contributors × free tiers = enterprise-scale compute
- core monitor aggregates findings from all sources
- Tasks routed to Host UK packages AND unfunded OSS projects
- LLMs learned from OSS, we give back
Who pays: Microsoft, Google, Groq (marketing budgets)
Who benefits: Open source commons
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add read:project,project scopes to gh auth in install scripts
- Update troubleshooting docs for missing scopes
- Enable GitHub Projects access for workspace management
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add GitHub Actions workflow to test install scripts on Linux, macOS, Windows
- Runs weekly to catch upstream package changes
- Update install-deps.sh to configure gh with workflow scope
- Document workflow scope in README.md and CLAUDE.md troubleshooting
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Separate local declaration from assignment to avoid masking errors (SC2155)
- Add exit code check after Homebrew installer execution
- Add exit code check after NodeSource setup script execution
- Add LASTEXITCODE check after Chocolatey installer execution
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add SHA256 checksum verification to install-core.sh binary download
- Add version pinning (v0.1.0) to install-core.sh matching PowerShell version
- Use mktemp for secure temp files instead of predictable /tmp/core
- Add symlink detection to prevent directory traversal attacks
- Add GPG signature verification for git tags when available
- Add checksum verification for Go binary in install-deps.sh
- Add SHA384 signature verification for Composer installer
- Replace Invoke-Expression with download-verify-execute in install-deps.ps1
- Download Homebrew/NodeSource scripts to temp files before execution
- Add security documentation and warnings for external scripts
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add PowerShell 4.0+ version check at startup
- Add disk space check (100MB minimum) before install
- Add try/finally cleanup for download temp files (handles Ctrl+C)
- Fix PATH duplicate semicolons by trimming before append
- Update header with requirements documentation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
install-core.ps1:
- Add Test-SecureDirectory and New-SecureDirectory to mitigate TOCTOU races
- Add Test-GitTagSignature for GPG verification of git tags
- Make ACL failures fatal for temp directories with retry logic
- Use precise PATH matching instead of substring contains
- Add unique GUID suffix to temp file names
- Document security controls and known limitations in header
setup.bat:
- Validate LOCALAPPDATA is within USERPROFILE
- Reject paths with invalid shell characters
- Add symlink detection for install directory
- Use delayed expansion variables for path safety
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add SHA256 hash verification for downloaded binaries
- Pin to specific version (v0.1.0) instead of dev tag
- Validate LOCALAPPDATA is within user profile
- Detect symlink attacks on install directory
- Set restrictive ACL (owner-only) on temp build directories
- Validate PATH entries before modification
- Improve error handling with specific exception types
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Ensures Pop-Location is always called, even if Write-Err exits early.
Makes the cleanup pattern consistent and easier to maintain.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add git prerequisite check before cloning
- Check $LASTEXITCODE after git clone and go build
- Wrap build logic in try/finally for guaranteed temp cleanup
- Add error check after core setup command in batch file
- Show warning if core doctor reports issues
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use Join-Path for reliable path handling in PowerShell
- Replace fragile New-TemporaryFile with GetTempPath + GUID
- Enable delayed expansion in batch for reliable errorlevel checks
- Add call statements for proper subprocess error propagation
- Verify core.exe exists before running commands
- Update repo reference and build path
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add Makefile for make-based workflow
- Add setup.sh / setup.bat for one-command bootstrap
- Add scripts/install-deps.sh for macOS/Linux dependencies
- Add scripts/install-deps.ps1 for Windows (Chocolatey)
- Add scripts/install-core.sh to build/download core CLI
- Add scripts/install-core.ps1 for Windows
- Update README with installation instructions
Developers can now run:
macOS/Linux: ./setup.sh (or make setup)
Windows: .\setup.bat (as Admin)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
