schaefera/pkgwatch
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
pkgwatch/packages.d/claude-code.toml

51 lines
2.4 KiB
TOML
Raw Normal View History

Track anthropics/claude-code releases Same-origin-sha256 (tier 4) against SHASUMS256.txt — no GitHub attestations upstream. A PGP signature over the checksum file also ships (SHASUMS256.txt.sig) but pkgwatch has no minisign/GPG verifier yet; revisit once tier 1 lands. Tracks the glibc x86_64 Linux build. Confirmed working end to end: check -> fetch -> verify against the real repo (v2.1.276 at time of writing). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 09:56:34 +00:00
# Verified 2026-09-18 against the real repo: anthropics/claude-code does not
# publish GitHub build-provenance attestations (the attestations API 404s
# for a fresh release asset) — tier 4, same-origin checksum only, not tier
# 2. Motivation: track the fast-moving Claude Code CLI directly from
# upstream releases rather than npm/curl|sh.
#
# Releases ship a combined `SHASUMS256.txt` (one line per platform asset,
# same `<hash> <filename>` shape as scaleway-cli's `SHA256SUMS`) plus a
# detached `SHASUMS256.txt.sig` PGP signature over that checksum file —
# stronger than plain same-origin-sha256 (closer to tier 1, pinned-key
# signature) but pkgwatch doesn't implement PGP/minisign verification yet
# (see SPEC.md > Status: tier-1 `minisign` method not yet implemented).
# Revisit and upgrade this package's tier once that lands.
#
# Release tags are static per-platform filenames (no version embedded), so
# no `{version}` placeholder is needed, same as uv's config. Tracking the
# glibc x86_64 Linux build (`claude-linux-x64.tar.gz`), not the musl
# variant, to match this machine.
Add a third builder shape for archives with no wrapping directory Merging master's claude-code.toml onto this branch surfaced a real gap: builder.rs only knew "bare binary download" and "tarball extracting into a same-named directory" (uv). claude-code's tarball extracts a bare `claude` file with no wrapping directory, and that inner filename doesn't match the package name either — makepkg's package() failed with "cannot stat .../claude-linux-x64/claude-code" (confirmed by actually running the build). Add Package::archive_binary_path, an explicit override for the in-archive path builder.rs installs from, used verbatim when present instead of the stem/binary_name convention. Set binary_name = "claude" too, matching the box's actual command name (/opt/claude-code/bin/claude) rather than the claude-code package name. Also added a sanity_check block (claude --version), matching uv's pattern, confirmed against the real built binary's output ("2.1.276 (Claude Code)"). Verified end to end against the real repo with PKGWATCH_REPO_DIR pointed at a scratch dir: check -> fetch -> verify -> review --approve -> build -> sanity-check -> publish all pass for claude-code v2.1.276. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 10:46:28 +00:00
#
# Archive shape doesn't match uv's or scaleway-cli's: the tarball extracts a
# bare `claude` file with no wrapping directory (confirmed via `tar tzvf`
# against the real v2.1.276 asset) — hence archive_binary_path below (see
# builder.rs's third shape). binary_name is also set explicitly to `claude`
# (the real upstream command name, not the `claude-code` package name) so
# the installed binary matches what this box already invokes as `claude`
# (see /opt/claude-code/bin/claude).
Track anthropics/claude-code releases Same-origin-sha256 (tier 4) against SHASUMS256.txt — no GitHub attestations upstream. A PGP signature over the checksum file also ships (SHASUMS256.txt.sig) but pkgwatch has no minisign/GPG verifier yet; revisit once tier 1 lands. Tracks the glibc x86_64 Linux build. Confirmed working end to end: check -> fetch -> verify against the real repo (v2.1.276 at time of writing). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 09:56:34 +00:00
[package.claude-code]
repo = "anthropics/claude-code"
asset_pattern = "claude-linux-x64.tar.gz"
Add a third builder shape for archives with no wrapping directory Merging master's claude-code.toml onto this branch surfaced a real gap: builder.rs only knew "bare binary download" and "tarball extracting into a same-named directory" (uv). claude-code's tarball extracts a bare `claude` file with no wrapping directory, and that inner filename doesn't match the package name either — makepkg's package() failed with "cannot stat .../claude-linux-x64/claude-code" (confirmed by actually running the build). Add Package::archive_binary_path, an explicit override for the in-archive path builder.rs installs from, used verbatim when present instead of the stem/binary_name convention. Set binary_name = "claude" too, matching the box's actual command name (/opt/claude-code/bin/claude) rather than the claude-code package name. Also added a sanity_check block (claude --version), matching uv's pattern, confirmed against the real built binary's output ("2.1.276 (Claude Code)"). Verified end to end against the real repo with PKGWATCH_REPO_DIR pointed at a scratch dir: check -> fetch -> verify -> review --approve -> build -> sanity-check -> publish all pass for claude-code v2.1.276. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 10:46:28 +00:00
binary_name = "claude"
archive_binary_path = "claude"
Track anthropics/claude-code releases Same-origin-sha256 (tier 4) against SHASUMS256.txt — no GitHub attestations upstream. A PGP signature over the checksum file also ships (SHASUMS256.txt.sig) but pkgwatch has no minisign/GPG verifier yet; revisit once tier 1 lands. Tracks the glibc x86_64 Linux build. Confirmed working end to end: check -> fetch -> verify against the real repo (v2.1.276 at time of writing). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 09:56:34 +00:00
[package.claude-code.verification]
method = "same-origin-sha256"
checksum_asset_pattern = "SHASUMS256.txt"
Add a third builder shape for archives with no wrapping directory Merging master's claude-code.toml onto this branch surfaced a real gap: builder.rs only knew "bare binary download" and "tarball extracting into a same-named directory" (uv). claude-code's tarball extracts a bare `claude` file with no wrapping directory, and that inner filename doesn't match the package name either — makepkg's package() failed with "cannot stat .../claude-linux-x64/claude-code" (confirmed by actually running the build). Add Package::archive_binary_path, an explicit override for the in-archive path builder.rs installs from, used verbatim when present instead of the stem/binary_name convention. Set binary_name = "claude" too, matching the box's actual command name (/opt/claude-code/bin/claude) rather than the claude-code package name. Also added a sanity_check block (claude --version), matching uv's pattern, confirmed against the real built binary's output ("2.1.276 (Claude Code)"). Verified end to end against the real repo with PKGWATCH_REPO_DIR pointed at a scratch dir: check -> fetch -> verify -> review --approve -> build -> sanity-check -> publish all pass for claude-code v2.1.276. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 10:46:28 +00:00
[package.claude-code.sanity_check]
command = "claude --version"
version_regex = '(\d+\.\d+\.\d+) \(Claude Code\)'
Add wrapper-script env var support for claude-code's self-update guard The previously-installed claude-code package (2.1.273-1, an AUR build) wraps its real binary in a /usr/bin/claude script that sets DISABLE_UPDATES=1 and DISABLE_INSTALLATION_CHECKS=1 before exec-ing /opt/claude-code/bin/claude — almost certainly to stop Claude Code's own self-updater from fighting with a package manager already managing it, which applies just as much to a pkgwatch-managed install. The generated PKGBUILD had no way to replicate that: it only ever wrote one file. Add Package::env (a sorted BTreeMap for deterministic output). When set and non-empty, builder.rs now installs the real binary under /usr/lib/<pkgname>/ and generates a /usr/bin/<binary_name> wrapper that exports the declared vars before exec-ing it, written inline via a quoted heredoc (no bash expansion at PKGBUILD-build time). The wrapper finds its sibling binary via $(dirname "$0") rather than a hardcoded absolute path, since /bin/sh is bash on this box and sets $0 to the full resolved path when found via PATH (confirmed empirically) — so the same wrapper resolves correctly both under sanity.rs's staging-directory pkgdir check and after a real pacman install. Wired claude-code.toml to declare both vars. Verified end to end against a scratch repo: build succeeds, the sanity check (which now runs through the wrapper, not the raw binary) passes, and the built package's wrapper genuinely exports both vars at runtime before exec-ing the real binary (confirmed by hand, substituting the exec line for an env dump). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-18 11:07:03 +00:00
# The previously-installed AUR package (claude-code 2.1.273-1) shipped these
# via a /usr/bin/claude wrapper around the real /opt/claude-code/bin/claude
# binary — almost certainly to stop Claude Code's own self-updater from
# fighting with a package manager already managing it, which applies just
# as much here. builder.rs replicates that wrapper when `env` is set: real
# binary under /usr/lib/claude-code/, generated /usr/bin/claude wrapper.
[package.claude-code.env]
DISABLE_UPDATES = "1"
DISABLE_INSTALLATION_CHECKS = "1"
Reference in a new issue Copy permalink