From 28ec633505e25a7be5a38a29ed68dcb1c24b76b9 Mon Sep 17 00:00:00 2001 From: Elmehdi Aitbrahim Date: Fri, 28 Aug 2026 20:30:00 -0400 Subject: [PATCH] =?UTF-8?q?fix(roadmap,install):=20review=20fast-follows?= =?UTF-8?q?=20=E2=80=94=20closed-milestone=20truncation=20+=20checksum=20s?= =?UTF-8?q?cope=20(#127)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - fetch-milestones.mjs: per_page 10→100 for closed milestones — the API returns default (number) order, so per_page=10 silently hid the four newest closures (Phase 14 Self-update, Phase 13 TUI, both 2026-08-19) and the recency sort picked from the wrong set. Verified with token: top-5 closed now the actual newest five. - install.ts ×3: 'attached to every release' → 'every release since v0.12.0' — only 5 of 31 releases carry the per-platform checksum files (v0.11.0, v0.12.0-.2); the broader claim was false for 26 of them. Both from the run's independent review (GO-WITH-NOTES). --- scripts/fetch-milestones.mjs | 2 +- src/i18n/pages/install.ts | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/fetch-milestones.mjs b/scripts/fetch-milestones.mjs index ab70dda..aee71ce 100644 --- a/scripts/fetch-milestones.mjs +++ b/scripts/fetch-milestones.mjs @@ -24,7 +24,7 @@ const REPO_API = "https://api.github.com/repos/CodeGateSoftware/keel"; const MILESTONES_URL = "https://github.com/CodeGateSoftware/keel/milestones"; /** Open milestones first (that's the roadmap), then the recently shipped. */ const OPEN_API = `${REPO_API}/milestones?state=open&per_page=50`; -const CLOSED_API = `${REPO_API}/milestones?state=closed&per_page=10`; +const CLOSED_API = `${REPO_API}/milestones?state=closed&per_page=100`; /** Issues *and* PRs under one milestone — the issues endpoint returns both. */ const itemsApi = (number) => `${REPO_API}/issues?milestone=${number}&state=all&per_page=100`; diff --git a/src/i18n/pages/install.ts b/src/i18n/pages/install.ts index 72e3a05..ab72484 100644 --- a/src/i18n/pages/install.ts +++ b/src/i18n/pages/install.ts @@ -230,7 +230,7 @@ export const install: LocalizedPage = { ], verifyTitle: "Please check what you downloaded first", verifyLead: - "We would rather not simply ask you to click past a security warning — keel is a program you may give exchange API keys to. Every release carries proof of where its files came from, which answers the same question a certificate answers: was this built from keel's own source, by keel's own release pipeline? Per-platform checksum files are attached to every release too (SHA256SUMS-macOS-arm64.txt, -macOS-x86_64.txt, -Windows-x86_64.txt — one per download).", + "We would rather not simply ask you to click past a security warning — keel is a program you may give exchange API keys to. Every release carries proof of where its files came from, which answers the same question a certificate answers: was this built from keel's own source, by keel's own release pipeline? Per-platform checksum files are attached to every release since v0.12.0 (SHA256SUMS-macOS-arm64.txt, -macOS-x86_64.txt, -Windows-x86_64.txt — one per download).", verifyFail: "If either check fails, do not open the file. A failing check means it is not the file we built, and no amount of clicking Open Anyway makes that safe.", notMeaningTitle: "What this does not mean", @@ -354,7 +354,7 @@ export const install: LocalizedPage = { ], verifyTitle: "من فضلك تحقّق ممّا نزّلته أولًا", verifyLead: - "لا يطيب لنا أن نطلب منك مجرّد تجاوز تحذيرٍ أمني — فكيل برنامجٌ قد تعطيه مفاتيح API لمنصّة تداول. وكلُّ إصدارٍ يحمل إثباتًا لمصدر ملفّاته، وهو يجيب عن السؤال نفسه الذي تجيب عنه الشهادة: هل بُني هذا من مصدر كيل نفسه، وعبر خطّ إصدار كيل نفسه؟ وتُرفق بكلّ إصدارٍ ملفاتُ بصماتٍ لكلّ منصّة (SHA256SUMS-macOS-arm64.txt و-macOS-x86_64.txt و-Windows-x86_64.txt — ملفٌّ لكلّ تنزيل).", + "لا يطيب لنا أن نطلب منك مجرّد تجاوز تحذيرٍ أمني — فكيل برنامجٌ قد تعطيه مفاتيح API لمنصّة تداول. وكلُّ إصدارٍ يحمل إثباتًا لمصدر ملفّاته، وهو يجيب عن السؤال نفسه الذي تجيب عنه الشهادة: هل بُني هذا من مصدر كيل نفسه، وعبر خطّ إصدار كيل نفسه؟ وتُرفق بكلّ إصدارٍ منذ v0.12.0 ملفاتُ بصماتٍ لكلّ منصّة (SHA256SUMS-macOS-arm64.txt و-macOS-x86_64.txt و-Windows-x86_64.txt — ملفٌّ لكلّ تنزيل).", verifyFail: "إن أخفق أيٌّ من الفحصين فلا تفتح الملفّ. فإخفاقه يعني أنه ليس الملفّ الذي بنيناه، ولن يجعله الضغطُ على ‏Open Anyway آمنًا.", notMeaningTitle: "ما لا يعنيه هذا التحذير", @@ -478,7 +478,7 @@ export const install: LocalizedPage = { ], verifyTitle: "Vérifiez d'abord ce que vous avez téléchargé", verifyLead: - "Nous préférons ne pas nous contenter de vous demander de passer outre un avertissement de sécurité : keel est un programme auquel vous confierez peut-être les clés d'API d'une plateforme d'échange. Chaque version porte une preuve de l'origine de ses fichiers, qui répond à la même question qu'un certificat : ce fichier a-t-il bien été construit à partir des sources de keel, par la chaîne de publication de keel ? Des fichiers de somme de contrôle par plateforme accompagnent chaque version (SHA256SUMS-macOS-arm64.txt, -macOS-x86_64.txt, -Windows-x86_64.txt — un par téléchargement).", + "Nous préférons ne pas nous contenter de vous demander de passer outre un avertissement de sécurité : keel est un programme auquel vous confierez peut-être les clés d'API d'une plateforme d'échange. Chaque version porte une preuve de l'origine de ses fichiers, qui répond à la même question qu'un certificat : ce fichier a-t-il bien été construit à partir des sources de keel, par la chaîne de publication de keel ? Des fichiers de somme de contrôle par plateforme accompagnent chaque version depuis la v0.12.0 (SHA256SUMS-macOS-arm64.txt, -macOS-x86_64.txt, -Windows-x86_64.txt — un par téléchargement).", verifyFail: "Si l'une des deux vérifications échoue, n'ouvrez pas le fichier. Un échec signifie que ce n'est pas le fichier que nous avons construit, et aucun « Ouvrir quand même » n'y changera rien.", notMeaningTitle: "Ce que cela ne signifie pas",