Ship a binary per platform, and tell people to curl it

[sotashimozono]

The extension is on the store and public, so people arrive without a Rust toolchain or a C compiler. What the release carried was the extension zip, so the only way to the daemon was cargo install, which needs both.

Four targets now — windows-msvc, both darwins, linux-gnu. The Linux one builds on the older runner on purpose: a binary linked against a newer glibc will not start on an older one, and the people this is for are on login nodes somebody else administers. musl would remove that floor and is not here yet, because ring wants a C toolchain targeting musl and an untested build inside a release job fails at the worst moment.

Unsigned, on purpose

Gatekeeper and SmartScreen act on a flag the downloading application attaches — com.apple.quarantine, Mark-of-the-Web — and curl and scp attach neither. Measured on the binary this produced:

no alternate data stream — no Mark-of-the-Web

So the README leads with curl and says why, and the extension's no-daemon screen prints a curl line for the platform reading it rather than linking to a page somebody would download from. Signing is a few hundred a year to remove a warning from the one route nothing here recommends.

cargo binstall ssh-browser works off the same assets, spelled out in [package.metadata.binstall] rather than left to the defaults: binstall tries several name shapes and a near-miss falls back to building from source — the compiler this exists to avoid, arrived at silently.

Two things the dispatch runs found

The workflow was run against the existing v0.5.1 tag three times before being wired into a release, which is what turned both of these into test failures instead of broken releases.

shasum: command not found on Windows. Git Bash there has sha256sum and not shasum; the three Unix runners have both, so the wrong one of the pair looked fine everywhere it was tried.

A 404 on the README's own URL. releases/latest/download/<name> is the link that never goes stale and it cannot interpolate a version, so an asset named ssh-browser-0.5.1-x86_64-... is unreachable through it. Found by running the command the README gives rather than reading it. The name lost the version; a pinned download still carries it in the path.

Verified end to end

download: http 200, 5101056 bytes
sha256:   MATCH (3df8afbe…)
./ssh-browser.exe  ->  usage: ssh-browser serve …

230 tests, 65 e2e checks against a real host. The e2e check on the no-daemon screen asserted cargo install; it now asserts a download, and separately that no bare URL appears — a link is the one thing that would put the quarantine flag back.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!