ci: bump cozyvalues-gen pin to v1.5.0 - #2730

#!/bin/bash
set -euo pipefail
release="v1.5.0"
base="https://github.com/cozystack/cozyvalues-gen/releases/download/${release}"
curl -fsSL "${base}/cozyvalues-gen-linux-amd64.tar.gz" -o /tmp/cozyvalues-gen-linux-amd64.tar.gz
sha256sum /tmp/cozyvalues-gen-linux-amd64.tar.gz
# If published by the release, fetch and inspect:
curl -fsSL "${base}/checksums.txt" -o /tmp/checksums.txt || true
[ -f /tmp/checksums.txt ] && grep -n "cozyvalues-gen-linux-amd64.tar.gz" /tmp/checksums.txt || true

#!/bin/bash
set -euo pipefail

release="v1.5.0"
base="https://github.com/cozystack/cozyvalues-gen/releases/download/${release}"
tarball="cozyvalues-gen-linux-amd64.tar.gz"
url="${base}/${tarball}"
tmp_tar="/tmp/${tarball}"

echo "== Downloading tarball =="
curl -fsSL "$url" -o "$tmp_tar"

echo "== Computing SHA-256 (try common tools) =="
if command -v sha256sum >/dev/null 2>&1; then
  sha256sum "$tmp_tar"
elif command -v shasum >/dev/null 2>&1; then
  shasum -a 256 "$tmp_tar"
elif command -v openssl >/dev/null 2>&1; then
  openssl dgst -sha256 "$tmp_tar"
else
  echo "No SHA-256 tool available (sha256sum/shasum/openssl missing)" >&2
  exit 1
fi

echo "== Looking for checksums files commonly published with releases =="
for f in checksums.txt checksum.txt checksums.sha256 checksums.sha256.txt SHA256SUMS SHA256SUMS.txt .sha256 .sha256.txt; do
  test_url="${base}/${f}"
  code="$(curl -sS -o /dev/null -w "%{http_code}" "$test_url" || true)"
  if [ "$code" = "200" ]; then
    echo "Found: $test_url"
    curl -fsSL "$test_url" -o "/tmp/${f}"
    echo "== Preview ($f) =="
    head -n 30 "/tmp/${f}" | sed 's/\r$//'
    if rg -n --fixed-string "$tarball" "/tmp/${f}" >/dev/null 2>&1; then
      echo "== Matching lines for $tarball in $f =="
      rg -n --fixed-string "$tarball" "/tmp/${f}" || true
    fi
    break
  fi
done

echo "== Also check for detached signatures (common) =="
for f in "$tarball.asc" "$tarball.sig"; do
  sig_url="${base}/${f}"
  code="$(curl -sS -o /dev/null -w "%{http_code}" "$sig_url" || true)"
  echo "$sig_url -> $code"
done

#!/bin/bash
set -euo pipefail

release="v1.5.0"
tarball="cozyvalues-gen-linux-amd64.tar.gz"
base="https://github.com/cozystack/cozyvalues-gen/releases/download/${release}"
url="${base}/${tarball}"
tmp_tar="/tmp/${tarball}"

echo "== Basic environment =="
command -v python3 || true
command -v jq || true
echo "== Downloading tarball =="
curl -fsSL "$url" -o "$tmp_tar"

echo "== Computing SHA-256 (via python) =="
python3 - <<'PY'
import hashlib, pathlib
p = pathlib.Path("/tmp/cozyvalues-gen-linux-amd64.tar.gz")
h = hashlib.sha256()
with p.open("rb") as f:
    for chunk in iter(lambda: f.read(1024*1024), b""):
        h.update(chunk)
print(h.hexdigest())
PY

echo "== Checking for common checksum files =="
for f in checksums.txt checksum.txt checksums.sha256 checksums.sha256.txt SHA256SUMS SHA256SUMS.txt .sha256 .sha256.txt; do
  test_url="${base}/${f}"
  code="$(curl -sS -o /dev/null -w "%{http_code}" "$test_url" || true)"
  if [ "$code" = "200" ]; then
    echo "Found: $test_url"
    curl -fsSL "$test_url" -o "/tmp/${f}"
    head -n 40 "/tmp/${f}" | sed 's/\r$//'
    echo "== Lines matching tarball =="
    rg -n --fixed-string "$tarball" "/tmp/${f}" || true
  fi
done

echo "== Checking release assets via GitHub API =="
api_url="https://api.github.com/repos/cozystack/cozyvalues-gen/releases/tags/${release}"
curl -fsSL "$api_url" -o /tmp/release.json
python3 - <<'PY'
import json, pathlib
data = json.loads(pathlib.Path("/tmp/release.json").read_text())
assets = data.get("assets", [])
print("asset_count:", len(assets))
for a in assets:
    name = a.get("name")
    u = a.get("browser_download_url")
    if any(k in (name or "").lower() for k in ["sha", "sum", "sig", "asc", "checksum"]):
        print(name, u)
PY

#!/bin/bash
set -euo pipefail

# 1) Inspect workflow snippet around the install command
echo "== Workflow snippet =="
sed -n '35,70p' .github/workflows/pre-commit.yml | nl -ba

# 2) Download checksum file and verify tarball hash is present/matching
release="v1.5.0"
tarball="cozyvalues-gen-linux-amd64.tar.gz"
base="https://github.com/cozystack/cozyvalues-gen/releases/download/${release}"
checksum_file="cozyvalues-gen-checksums.txt"
checksum_url="${base}/${checksum_file}"

tmp_tar="/tmp/${tarball}"
tmp_checksums="/tmp/${checksum_file}"

echo "== Download tarball (if not present) =="
curl -fsSL "${base}/${tarball}" -o "$tmp_tar" >/dev/null

echo "== Download checksums file =="
curl -fsSL "$checksum_url" -o "$tmp_checksums"

echo "== Tarball SHA-256 =="
python3 - <<'PY'
import hashlib, pathlib
p = pathlib.Path("/tmp/cozyvalues-gen-linux-amd64.tar.gz")
h = hashlib.sha256()
with p.open("rb") as f:
    for chunk in iter(lambda: f.read(1024*1024), b""):
        h.update(chunk)
print(h.hexdigest())
PY

echo "== Search checksum file for tarball =="
rg -n --fixed-string "$tarball" "$tmp_checksums" || true

echo "== If checksum file format is hash+filename, extract the hash =="
python3 - <<'PY'
import re, pathlib
tarball="cozyvalues-gen-linux-amd64.tar.gz"
text=pathlib.Path("/tmp/cozyvalues-gen-checksums.txt").read_text(errors="replace").splitlines()
pat=re.compile(r'^\s*([0-9a-fA-F]{64})\s+.*'+re.escape(tarball)+r'\s*$')
for line in text:
    m=pat.match(line)
    if m:
        print("matched_sha256:", m.group(1))
        break
else:
    print("matched_sha256: not found (unknown checksums.txt format)")
PY

#!/bin/bash
set -euo pipefail

echo "== Find workflow line containing cozyvalues-gen-linux-amd64.tar.gz =="
rg -n --fixed-string "cozyvalues-gen-linux-amd64.tar.gz" .github/workflows/pre-commit.yml

echo "== Print surrounding lines with line numbers (40-60) =="
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/pre-commit.yml")
lines = p.read_text().splitlines()
for i in range(35, 66):  # 1-based display
    if 1 <= i <= len(lines):
        print(f"{i}:{lines[i-1]}")
PY

echo "== Download checksum file and compare tarball SHA-256 =="
release="v1.5.0"
tarball="cozyvalues-gen-linux-amd64.tar.gz"
base="https://github.com/cozystack/cozyvalues-gen/releases/download/${release}"
checksum_file="cozyvalues-gen-checksums.txt"
checksum_url="${base}/${checksum_file}"

tmp_tar="/tmp/${tarball}"
tmp_checksums="/tmp/${checksum_file}"

curl -fsSL "${base}/${tarball}" -o "$tmp_tar"
curl -fsSL "$checksum_url" -o "$tmp_checksums"

python3 - <<'PY'
import hashlib, pathlib, re
tarball="cozyvalues-gen-linux-amd64.tar.gz"
tar=pathlib.Path("/tmp/"+tarball)
h=hashlib.sha256(tar.read_bytes()).hexdigest()
print("computed_sha256:", h)

text=pathlib.Path("/tmp/cozyvalues-gen-checksums.txt").read_text(errors="replace").splitlines()

# Try common formats: "<sha>  <filename>" or "<filename> : <sha>"
sha_from_file=None
for line in text:
    line=line.strip()
    m=re.match(r'^([0-9a-fA-F]{64})\s+\*?'+re.escape(tarball)+r'\s*$', line)
    if m:
        sha_from_file=m.group(1); break
    m=re.search(r''+re.escape(tarball)+r'.*?\b([0-9a-fA-F]{64})\b', line)
    if m:
        sha_from_file=m.group(1); break

print("sha_in_checksums:", sha_from_file)
if sha_from_file:
    print("sha_match:", sha_from_file.lower()==h.lower())
else:
    print("sha_match: unknown (could not parse checksums file)")
PY

echo "== Show checksum-file lines that mention the tarball =="
rg -n --fixed-string "$tarball" "$tmp_checksums" || true

#!/bin/bash
set -euo pipefail

echo "== Find workflow line containing cozyvalues-gen-linux-amd64.tar.gz =="
rg -n --fixed-strings "cozyvalues-gen-linux-amd64.tar.gz" .github/workflows/pre-commit.yml

echo "== Print workflow lines around the match (40-70) =="
python3 - <<'PY'
from pathlib import Path
p = Path(".github/workflows/pre-commit.yml")
lines = p.read_text().splitlines()
start, end = 40, 70
for i in range(start, min(end, len(lines)) + 1):
    print(f"{i}:{lines[i-1]}")
PY

echo "== Download checksum file and compare tarball SHA-256 =="
release="v1.5.0"
tarball="cozyvalues-gen-linux-amd64.tar.gz"
base="https://github.com/cozystack/cozyvalues-gen/releases/download/${release}"
checksum_file="cozyvalues-gen-checksums.txt"

tmp_tar="/tmp/${tarball}"
tmp_checksums="/tmp/${checksum_file}"

curl -fsSL "${base}/${tarball}" -o "$tmp_tar"
curl -fsSL "${base}/${checksum_file}" -o "$tmp_checksums"

python3 - <<'PY'
import hashlib, pathlib, re
tarball="cozyvalues-gen-linux-amd64.tar.gz"
h=hashlib.sha256(pathlib.Path("/tmp/"+tarball).read_bytes()).hexdigest()
print("computed_sha256:", h)

text=pathlib.Path("/tmp/cozyvalues-gen-checksums.txt").read_text(errors="replace").splitlines()

sha_from_file=None
for line in text:
    l=line.strip()
    m=re.match(r'^([0-9a-fA-F]{64})\s+\*?'+re.escape(tarball)+r'\s*$', l)
    if m:
        sha_from_file=m.group(1); break
    m=re.search(re.escape(tarball)+r'.*?\b([0-9a-fA-F]{64})\b', l)
    if m:
        sha_from_file=m.group(1); break

print("sha_in_checksums:", sha_from_file)
print("sha_match:", sha_from_file.lower()==h.lower() if sha_from_file else "unknown")
PY

echo "== Show checksum-file lines that mention the tarball =="
rg -n --fixed-strings "$tarball" "$tmp_checksums" || true