mirror of
https://github.com/storytold/craft-libs.git
synced 2026-11-12 21:42:13 +00:00
Review follow-ups on the two commits before: - check_download_link also requires the release's SHA256SUMS.txt to be its own link: the download is verified against it, and a feed- or cache-built release only had the prefix check. - tag_from_redirect refuses `.` and `..`, which its character list let through and which source.rs would then put in the SHA256SUMS.txt link. - linux_location: /usr/local belongs to the user, not a package manager, so a copy there keeps updating itself; Nix and Snap stores are left alone like /usr and /opt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>