Feat: one-line installer that downloads and starts the local demo - #718
Conversation
|
Warning Review limit reached
Next review available in: 27 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe local quick start now uses ChangesLocal demo installation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Developer
participant install_demo.sh
participant GitHub_Releases
participant Local_bin
participant authbridge_proxy
Developer->>install_demo.sh: Start local demo setup
install_demo.sh->>GitHub_Releases: Download binaries and checksums
install_demo.sh->>Local_bin: Verify and install binaries
install_demo.sh->>authbridge_proxy: Launch demo proxy
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@authbridge/install-demo.sh`:
- Around line 76-84: Update the checksum verification flow in install-demo.sh to
authenticate checksums.txt using a pinned trusted signing key or identity
obtained independently of the mutable release assets before running sha_check.
Ensure installation aborts when manifest signature or provenance verification
fails, then retain the existing platform filtering and archive checksum
validation.
- Around line 1-14: Keep install-demo.sh compatible with its advertised POSIX sh
and curl | sh contract: avoid relying on pipefail by rewriting the
release-resolution pipeline so grep failures propagate without it, and replace
both EXIT trap conditions with the POSIX-compatible zero-status condition.
Preserve the existing release selection, cleanup, and installation behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7ac5e997-0131-4eb1-a78a-fa7a287704f8
📒 Files selected for processing (2)
README.mdauthbridge/install-demo.sh
| #!/bin/sh | ||
| # install-demo.sh — one-line installer + launcher for the Cortex local demo. | ||
| # | ||
| # curl -fsSL https://raw.githubusercontent.com/rossoctl/cortex/main/authbridge/install-demo.sh | sh | ||
| # | ||
| # Detects your OS/arch, downloads the prebuilt `abctl` and `authbridge-proxy` | ||
| # binaries for the newest release, verifies their SHA-256 checksums, installs | ||
| # them to ~/.local/bin, and starts `authbridge-proxy --demo` (Ctrl-C to stop). | ||
| # macOS + Linux, amd64 + arm64. No cluster, Keycloak, or SPIRE needed. | ||
| # | ||
| # Environment: | ||
| # AUTHBRIDGE_VERSION=vX.Y.Z install a specific release tag (default: newest) | ||
| # AUTHBRIDGE_INSTALL_ONLY=1 install the binaries but do not start the demo | ||
| set -eu |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/sh
for shell in /bin/sh dash bash; do
command -v "$shell" >/dev/null 2>&1 || continue
printf '%s: ' "$shell"
"$shell" -c 'set -euo pipefail; trap ":" EXIT'
printf 'status=%s\n' "$?"
doneRepository: rossoctl/cortex
Length of output: 186
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)authbridge/install-demo\.sh$|(^|/)authbridge/' | head -200
echo "== target outline =="
wc -l authbridge/install-demo.sh
ast-grep outline authbridge/install-demo.sh || true
echo "== relevant sections =="
sed -n '1,120p' authbridge/install-demo.sh
sed -n '120,190p' authbridge/install-demo.sh
echo "== pipeline/options references =="
rg -n "set -|pipefail|trap|curl \\| sh|curl.*\\|.*sh|\\| " authbridge/install-demo.shRepository: rossoctl/cortex
Length of output: 10032
🏁 Script executed:
#!/bin/bash
set -u
echo "== target exists =="
if [ -f authbridge/install-demo.sh ]; then
wc -l authbridge/install-demo.sh
else
echo "missing authbridge/install-demo.sh"
fi
echo "== target relevant lines =="
if [ -f authbridge/install-demo.sh ]; then
sed -n '1,120p' authbridge/install-demo.sh
echo "-- later relevant lines --"
sed -n '120,190p' authbridge/install-demo.sh
fi
echo "== options/pipeline references =="
if [ -f authbridge/install-demo.sh ]; then
rg -n "set -|pipefail|trap|curl \\| sh|curl.*\\|.*sh|\\| " authbridge/install-demo.sh || true
fi
echo "== shell pipefail/trap support =="
for shell in /bin/sh dash bash; do
command -v "$shell" >/dev/null 2>&1 || continue
printf '%s: ' "$shell"
"$shell" -c 'set -euo pipefail; trap ":" EXIT' >/dev/null 2>&1
ret=$?
printf "status=%s\n" "$ret"
doneRepository: rossoctl/cortex
Length of output: 6749
Align the installer shell policy with its advertised sh contract.
Line 14 does not use the required pipefail setting, so the release-resolution pipeline can suppress failures from grep -m1. Enabling it keeps the current #!/bin/sh contract but conflicts with POSIX sh; the documented curl | sh payload should be updated to require Bash, or the script should avoid pipelines and keep pipefail disabled. Also replace trap ... EXIT at Lines 69 and 103 with trap ... 0 for POSIX compatibility.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@authbridge/install-demo.sh` around lines 1 - 14, Keep install-demo.sh
compatible with its advertised POSIX sh and curl | sh contract: avoid relying on
pipefail by rewriting the release-resolution pipeline so grep failures propagate
without it, and replace both EXIT trap conditions with the POSIX-compatible
zero-status condition. Preserve the existing release selection, cleanup, and
installation behavior.
Source: Coding guidelines
| curl -fsSL "${base}/${abctl_tgz}" -o "${tmp}/${abctl_tgz}" || die "download failed: ${abctl_tgz}" | ||
| curl -fsSL "${base}/${proxy_tgz}" -o "${tmp}/${proxy_tgz}" || die "download failed: ${proxy_tgz}" | ||
| curl -fsSL "${base}/checksums.txt" -o "${tmp}/checksums.txt" || die "download failed: checksums.txt" | ||
|
|
||
| info "Verifying checksums..." | ||
| # Select only this platform's two entries from checksums.txt, then verify. | ||
| grep "_${os}_${arch}.tar.gz" "${tmp}/checksums.txt" > "${tmp}/checksums.filtered" \ | ||
| || die "no checksum entries for ${os}/${arch} in checksums.txt" | ||
| ( cd "$tmp" && sha_check checksums.filtered ) || die "checksum verification failed" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Authenticate the release artifacts.
The checksum manifest is downloaded from the same mutable release location as both archives. An attacker able to replace release assets can replace all three files with matching hashes, so verification succeeds. Verify a signed manifest/provenance against a pinned trusted key or identity independent of release assets.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@authbridge/install-demo.sh` around lines 76 - 84, Update the checksum
verification flow in install-demo.sh to authenticate checksums.txt using a
pinned trusted signing key or identity obtained independently of the mutable
release assets before running sha_check. Ensure installation aborts when
manifest signature or provenance verification fails, then retain the existing
platform filtering and archive checksum validation.
4586c1f to
1d4c082
Compare
cwiklik
left a comment
cwiklik
left a comment
There was a problem hiding this comment.
Nicely done, security-conscious curl | sh installer. The important properties all check out:
set -eu; all downloads over HTTPS with-fsSL; installs user-scoped to~/.local/bin(no sudo/privilege escalation).- SHA-256 verification runs before extract/install (download → verify → extract ordering is correct), with
|| dieand ashasum/sha256sumfallback. mktemp -d+trap ... EXITcleanup; only the two expected binaries are moved out (existence-checked first); macOS quarantine clear is guarded; finalexecuses the full binary path rather than relying on PATH.- shellcheck-clean (with a justified
SC2016disable for the intentional literal$PWD), and the README is updated accurately with an inspect-first / build-from-source escape hatch.
One non-blocking robustness suggestion inline about the checksum filter. The inherent curl|sh caveat (the bootstrap script itself is fetched unpinned from main) is standard and already mitigated by the README note, so not flagging it.
All CI green (Shell Script Lint, CodeQL, Trivy, Bandit, pr-title, Pre-commit); signed commit; no .claude/.vscode. LGTM.
Assisted-By: Claude Code
|
|
||
| info "Verifying checksums..." | ||
| # Select only this platform's two entries from checksums.txt, then verify. | ||
| grep "_${os}_${arch}.tar.gz" "${tmp}/checksums.txt" > "${tmp}/checksums.filtered" \ |
There was a problem hiding this comment.
suggestion (non-blocking): grep "_${os}_${arch}.tar.gz" selects every checksums.txt entry for this platform, but only the two binaries are downloaded. If a future release ships a third per-platform artifact (e.g. an authbridge-envoy tarball), shasum -c would fail on a file that wasn't downloaded and break the installer even though abctl/authbridge-proxy verify fine. Consider filtering to exactly the two names being verified, e.g. grep -E "(${abctl_tgz}|${proxy_tgz})\$".
1d4c082 to
f7ae897
Compare
Add authbridge/install-demo.sh and make it the quickstart headline, so the local demo is a single command instead of a manual Releases-page download: curl -fsSL https://raw.githubusercontent.com/rossoctl/cortex/main/authbridge/install-demo.sh | sh The script (POSIX sh) detects OS/arch, resolves the newest release (listing /releases, since prereleases are excluded from releases/latest; AUTHBRIDGE_VERSION overrides), downloads the abctl + authbridge-proxy tarballs and checksums.txt, verifies the SHA-256 sums (shasum preferred — reliable on macOS; sha256sum fallback on Linux), installs both to ~/.local/bin, clears the macOS quarantine flag, prints the abctl / agent commands for the other terminals (full ~/.local/bin paths plus a PATH hint when it isn't on PATH), and execs `authbridge-proxy --demo`. AUTHBRIDGE_INSTALL_ONLY=1 installs without starting. README: collapse the download/unzip/xattr/PATH steps into the one-liner (build-from-source stays as the fallback) and trim the quickstart. Also reframe the intro: Cortex is a platform of easy-to-use services for agentic workloads (a sidecar in Kubernetes or a standalone binary elsewhere) — identity & access, guardrails, observability, egress control, and optimizations — with AuthBridge as its identity & access layer, not a former name for the project. Capabilities are stated in plain terms, not by plugin name. Test: shellcheck clean; ran end-to-end on darwin/arm64 against v0.7.0-alpha.1 — resolves the release, verifies checksums, installs, and starts the demo on loopback (forward proxy :8081 + session API :9094; no transparent listener). Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
f7ae897 to
d7923d0
Compare
github-project-automation
Bot
moved this from New/ToDo
to Done
in Rossoctl Issue Prioritization
3 participants
Summary
Makes the local quickstart a single command. Today a user has to click into the Releases page, pick the right tarball for their OS/arch, unzip it, clear the macOS quarantine, put the binaries on
PATH, and only then runauthbridge-proxy --demo. This replaces all of that with one line that also starts the demo:curl -fsSL https://raw.githubusercontent.com/rossoctl/cortex/main/authbridge/install-demo.sh | shChange
New
authbridge/install-demo.sh(POSIXsh,shellcheck-clean):{darwin,linux}×{amd64,arm64}; hard-fails otherwise — no Windows)./releases(thereleases/latestAPI excludes prereleases, and the project ships prereleases).AUTHBRIDGE_VERSION=vX.Y.Zoverrides.abctl+authbridge-proxytarballs andchecksums.txt, then verifies SHA-256 —shasumpreferred (reliable on macOS; some non-GNUsha256sumbuilds reject-c),sha256sumfallback on Linux.~/.local/bin, clears the macOScom.apple.quarantineflag.abctl) and terminal-3 (agent) commands — with full~/.local/bin/paths and a PATH hint when that dir isn't onPATH.exec authbridge-proxy --demo(foreground, Ctrl-C to stop).AUTHBRIDGE_INSTALL_ONLY=1installs without starting.README: collapse the download/unzip/
xattr/PATH steps into the one-liner (build-from-source stays as the fallback) and trim the quickstart. Also reframe the intro — Cortex is a platform of easy-to-use services for agentic workloads (a sidecar in Kubernetes or a standalone binary elsewhere): identity & access, guardrails, observability, egress control, optimizations, stated as plain capabilities rather than plugin names. AuthBridge is the identity & access layer, not a former name for the project.Design notes
main-pinned headline, release binaries. The script URL points atmain(script fixes reach users immediately); the binaries it installs come from the newest release.~/.local/binisn't onPATH, the script warns and uses full paths rather than editing shell rc files.Testing
shellcheckclean (viakoalaman/shellcheckcontainer).v0.7.0-alpha.1(sandboxedHOME): resolves the release → downloads → both checksums OK → installs to~/.local/bin→ binaries run (--version→v0.7.0-alpha.1) →--demostarts on loopback (forward proxy127.0.0.1:8081+ session API127.0.0.1:9094; no transparent listener, per the--demogate). Verified both theAUTHBRIDGE_INSTALL_ONLY=1path and the real start path.Assisted-By: Claude (Anthropic AI) noreply@anthropic.com