0044eda532
Merging master's claude-code.toml onto this branch surfaced a real gap:
builder.rs only knew "bare binary download" and "tarball extracting into
a same-named directory" (uv). claude-code's tarball extracts a bare
`claude` file with no wrapping directory, and that inner filename
doesn't match the package name either — makepkg's package() failed with
"cannot stat .../claude-linux-x64/claude-code" (confirmed by actually
running the build).
Add Package::archive_binary_path, an explicit override for the
in-archive path builder.rs installs from, used verbatim when present
instead of the stem/binary_name convention. Set binary_name = "claude"
too, matching the box's actual command name (/opt/claude-code/bin/claude)
rather than the claude-code package name. Also added a sanity_check
block (claude --version), matching uv's pattern, confirmed against the
real built binary's output ("2.1.276 (Claude Code)").
Verified end to end against the real repo with PKGWATCH_REPO_DIR
pointed at a scratch dir: check -> fetch -> verify -> review --approve
-> build -> sanity-check -> publish all pass for claude-code v2.1.276.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
40 lines
1.9 KiB
TOML
40 lines
1.9 KiB
TOML
# Verified 2026-09-18 against the real repo: anthropics/claude-code does not
|
|
# publish GitHub build-provenance attestations (the attestations API 404s
|
|
# for a fresh release asset) — tier 4, same-origin checksum only, not tier
|
|
# 2. Motivation: track the fast-moving Claude Code CLI directly from
|
|
# upstream releases rather than npm/curl|sh.
|
|
#
|
|
# Releases ship a combined `SHASUMS256.txt` (one line per platform asset,
|
|
# same `<hash> <filename>` shape as scaleway-cli's `SHA256SUMS`) plus a
|
|
# detached `SHASUMS256.txt.sig` PGP signature over that checksum file —
|
|
# stronger than plain same-origin-sha256 (closer to tier 1, pinned-key
|
|
# signature) but pkgwatch doesn't implement PGP/minisign verification yet
|
|
# (see SPEC.md > Status: tier-1 `minisign` method not yet implemented).
|
|
# Revisit and upgrade this package's tier once that lands.
|
|
#
|
|
# Release tags are static per-platform filenames (no version embedded), so
|
|
# no `{version}` placeholder is needed, same as uv's config. Tracking the
|
|
# glibc x86_64 Linux build (`claude-linux-x64.tar.gz`), not the musl
|
|
# variant, to match this machine.
|
|
#
|
|
# Archive shape doesn't match uv's or scaleway-cli's: the tarball extracts a
|
|
# bare `claude` file with no wrapping directory (confirmed via `tar tzvf`
|
|
# against the real v2.1.276 asset) — hence archive_binary_path below (see
|
|
# builder.rs's third shape). binary_name is also set explicitly to `claude`
|
|
# (the real upstream command name, not the `claude-code` package name) so
|
|
# the installed binary matches what this box already invokes as `claude`
|
|
# (see /opt/claude-code/bin/claude).
|
|
|
|
[package.claude-code]
|
|
repo = "anthropics/claude-code"
|
|
asset_pattern = "claude-linux-x64.tar.gz"
|
|
binary_name = "claude"
|
|
archive_binary_path = "claude"
|
|
|
|
[package.claude-code.verification]
|
|
method = "same-origin-sha256"
|
|
checksum_asset_pattern = "SHASUMS256.txt"
|
|
|
|
[package.claude-code.sanity_check]
|
|
command = "claude --version"
|
|
version_regex = '(\d+\.\d+\.\d+) \(Claude Code\)'
|