{ "_comment": [ "Pinned micromamba release + per-subdir SHA256 of the official GitHub release .tar.bz2 archive.", "fetch-micromamba.mjs downloads https://github.com/mamba-org/micromamba-releases/releases/download/<releaseTag>/micromamba-<subdir>.tar.bz2 and", "REQUIRES the sha256 here to match before it copies the binary into resources/bin — an unpinned", "or unverified binary is a supply-chain risk because it is signed/notarized with the app.", "", "IMPORTANT: download and hash the GitHub release tarball itself. Do not use micro.mamba.pm:", "it may re-package an existing version URL with different bytes and break reproducible builds.", "", "To repin (bump `version` and `releaseTag`, then regenerate every digest below):", " tag=2.8.1-1", " for s in osx-arm64 osx-64 linux-64 linux-aarch64 win-64; do", " curl -fsSL \"https://github.com/mamba-org/micromamba-releases/releases/download/$tag/micromamba-$s.tar.bz2\" | shasum -a 256 | awk -v s=$s '{print s, $1}'", " done", "The sha256 covers the downloaded .tar.bz2 archive (before extraction). binarySha256 covers the extracted executable before Windows release signing; the signed installed executable is checked with Authenticode at runtime.", "compatibility is a separately pinned final-1.x Windows runner, bundled so recovery never downloads executable code at runtime.", "To repin compatibility, update its version/releaseTag, hash the official win-64 tarball, extract Library/bin/micromamba.exe, and hash that executable independently.", "Before accepting a micromamba bump, revalidate the Windows managed-runtime fixtures for multi-cache search, URL-derived cache layout, and flat-cache fallback with LongPathsEnabled=0." ], "version": "2.8.1", "releaseTag": "2.8.1-1", "sha256": { "osx-arm64": "cf94f0d56cd38393ccbe12543e0378f77e6581dee8c4428d1fc563a859a0b070", "osx-64": "cd3c10cec65704c0a96195b46002d45350d0dd43a52d940e9dc17c517b7ee439", "linux-64": "8528263837623551a44464a372e5bd6b0b856479a83d2a77490a19dd98da3b06", "linux-aarch64": "daa4d5c7c5d688ce0deed4ff7887a4ff95429c89d80c76e39ab1ee3d5f66b913", "win-64": "e82874c473688860d087dfe825e1a52ae9deaf8099c7edaf3caff80e2687ed5d" }, "binarySha256": { "win-64": "b645a5259cb92b5869b0e60943390dd0d362cae45bc7e2f5ba8c7e4a4b06c7aa" }, "compatibility": { "version": "1.5.12", "releaseTag": "1.5.12-0", "sha256": { "win-64": "078a87f3f009586fed9450b085ed4801bf2aab552bb88da72d881db2cee40f89" }, "binarySha256": { "win-64": "3c2642b581d7fb00b4c8da0cae483276a2afca2b542740d8f5fde51448207727" } }}
{
"_comment": [
"Pinned micromamba release + per-subdir SHA256 of the official GitHub release .tar.bz2 archive.",
"fetch-micromamba.mjs downloads https://github.com/mamba-org/micromamba-releases/releases/download/<releaseTag>/micromamba-<subdir>.tar.bz2 and",
"REQUIRES the sha256 here to match before it copies the binary into resources/bin — an unpinned",
"or unverified binary is a supply-chain risk because it is signed/notarized with the app.",
"",
"IMPORTANT: download and hash the GitHub release tarball itself. Do not use micro.mamba.pm:",
"it may re-package an existing version URL with different bytes and break reproducible builds.",
"",
"To repin (bump `version` and `releaseTag`, then regenerate every digest below):",
" tag=2.8.1-1",
" for s in osx-arm64 osx-64 linux-64 linux-aarch64 win-64; do",
" curl -fsSL \"https://github.com/mamba-org/micromamba-releases/releases/download/$tag/micromamba-$s.tar.bz2\" | shasum -a 256 | awk -v s=$s '{print s, $1}'",
" done",
"The sha256 covers the downloaded .tar.bz2 archive (before extraction). binarySha256 covers the extracted executable before Windows release signing; the signed installed executable is checked with Authenticode at runtime.",
"compatibility is a separately pinned final-1.x Windows runner, bundled so recovery never downloads executable code at runtime.",
"To repin compatibility, update its version/releaseTag, hash the official win-64 tarball, extract Library/bin/micromamba.exe, and hash that executable independently.",
"Before accepting a micromamba bump, revalidate the Windows managed-runtime fixtures for multi-cache search, URL-derived cache layout, and flat-cache fallback with LongPathsEnabled=0."
],
"version": "2.8.1",
"releaseTag": "2.8.1-1",
"sha256": {
"osx-arm64": "cf94f0d56cd38393ccbe12543e0378f77e6581dee8c4428d1fc563a859a0b070",
"osx-64": "cd3c10cec65704c0a96195b46002d45350d0dd43a52d940e9dc17c517b7ee439",
"linux-64": "8528263837623551a44464a372e5bd6b0b856479a83d2a77490a19dd98da3b06",
"linux-aarch64": "daa4d5c7c5d688ce0deed4ff7887a4ff95429c89d80c76e39ab1ee3d5f66b913",
"win-64": "e82874c473688860d087dfe825e1a52ae9deaf8099c7edaf3caff80e2687ed5d"
},
"binarySha256": {
"win-64": "b645a5259cb92b5869b0e60943390dd0d362cae45bc7e2f5ba8c7e4a4b06c7aa"
},
"compatibility": {
"version": "1.5.12",
"releaseTag": "1.5.12-0",
"sha256": {
"win-64": "078a87f3f009586fed9450b085ed4801bf2aab552bb88da72d881db2cee40f89"
},
"binarySha256": {
"win-64": "3c2642b581d7fb00b4c8da0cae483276a2afca2b542740d8f5fde51448207727"
}
}
}