@sebastienrousseau/dotfiles 0.2.518 → 0.2.520

package/scripts/tools/figlet-banner.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/tools/log-rotate.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/tools/lolcat-wrap.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/tools/pipes.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 set -euo pipefail
 

package/scripts/tuning/linux.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Linux System Tuning (opt-in)
 # Managed by chezmoi - https://github.com/sebastienrousseau/dotfiles

package/scripts/tuning/macos.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # macOS tuning (opt-in)
 

package/scripts/uninstall.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Uninstall dotfiles and clean up all artifacts.
 

package/scripts/verify-release-versions

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+# Copyright (c) 2015-2026 Sebastien Rousseau
+#
+# verify-release-versions — assert every human-visible version surface
+# matches the canonical version in defaults/.chezmoidata.toml.
+#
+# This is the CI-checked "no stale install snippets" gate: install
+# one-liners, badges, the CLI banner, the man page, the agent/MCP
+# discovery cards, llms.txt and the CHANGELOG heading all have to
+# agree with the manifest BEFORE a release ships.
+#
+# Formerly scripts/qa/check-version-consistency.sh; that path remains
+# as a thin wrapper so existing callers keep working.
+#
+# Historical references (CHANGELOG entries, audit-doc closed-cycle
+# tables, roadmap docs that mention previous versions) are NOT
+# checked — they are intentionally pinned to the version they
+# describe.
+#
+# Usage:
+#   scripts/verify-release-versions           # verify
+#   scripts/verify-release-versions --fix     # auto-fix
+#   scripts/verify-release-versions --quiet   # rc-only
+#
+# Exit codes:
+#   0  every live reference matches
+#   1  drift detected (with diff printed unless --quiet)
+#   2  bad usage / missing canonical version
+
+set -euo pipefail
+
+# Honour a caller-supplied REPO_ROOT, matching scorecard-snapshot.sh,
+# a2a-conformance.sh and the other repo-scoped QA scripts. Lets the
+# checker run against a fixture tree without being copied into it.
+REPO_ROOT="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+cd "$REPO_ROOT"
+
+# ── Parse flags ─────────────────────────────────────────────────────────
+fix=0
+quiet=0
+for arg in "$@"; do
+  case "$arg" in
+    --fix) fix=1 ;;
+    --quiet | -q) quiet=1 ;;
+    -h | --help)
+      sed -n '5,29p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *)
+      echo "unknown flag: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+_log() { ((quiet)) || printf '%s\n' "$*"; }
+_err() { printf 'verify-release-versions: %s\n' "$*" >&2; }
+
+# ── Canonical version ──────────────────────────────────────────────────
+# `|| true`: when the key is absent grep exits 1, and under
+# `set -euo pipefail` that aborted the script right here — rc 1 with no
+# message, indistinguishable from "drift detected", and the documented
+# rc 2 below was unreachable. Let the emptiness check do the reporting.
+canonical="$(grep -E '^dotfiles_version[[:space:]]*=' defaults/.chezmoidata.toml 2>/dev/null |
+  head -1 | sed -E 's/.*"([^"]+)".*/\1/' || true)"
+
+if [[ -z "$canonical" ]]; then
+  _err 'failed to read dotfiles_version from defaults/.chezmoidata.toml'
+  exit 2
+fi
+_log "canonical: $canonical (defaults/.chezmoidata.toml)"
+
+# ── Per-file expected-substring map ────────────────────────────────────
+# Each entry: PATH|MATCH_PATTERN|EXPECTED_STRING
+# MATCH_PATTERN is a fixed substring to grep for on the file to
+# locate the version-bearing line; we then verify it contains the
+# expected substring rendered with $canonical. version-sync.sh
+# already handles many files (it reads package.json as source);
+# this list captures the surfaces version-sync.sh historically
+# missed — bento.sh banner, man-page header, dispatcher header.
+specs=(
+  "package.json|\"version\"|\"version\": \"${canonical}\""
+  "bin/dot|^VERSION=|VERSION=\"${canonical}\""
+  "bin/dot|^# Dotfiles CLI Entry Point - v|# Dotfiles CLI Entry Point - v${canonical}"
+  "share/man/man1/dot.1|^.TH DOT 1|dotfiles v${canonical}"
+  "lib/dot/bento.sh|D O T F I L E S|[v${canonical}]"
+  "README.md|img.shields.io/badge/Version|Version-v${canonical}-blue"
+  "CLAUDE.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
+  "AGENTS.md|^Chezmoi-managed dotfiles|Version \`${canonical}\`"
+  # Install snippet pinned to a tag — the "no stale install one-liner"
+  # rule from the repo standard. `main` snippets are deliberately
+  # unpinned and are not checked.
+  "README.md|raw.githubusercontent.com/sebastienrousseau/dotfiles/v|/dotfiles/v${canonical}/install.sh"
+  "install.sh|local version=\"v|local version=\"v${canonical}\""
+  "install.sh|\\(default: v|(default: v${canonical})"
+  # Machine-readable discovery surfaces: agents fetch these, so a stale
+  # version here misroutes tooling rather than merely reading wrong.
+  ".well-known/agent-card.json|\"version\"|\"version\": \"${canonical}\""
+  ".well-known/mcp/server-card.json|\"version\"|\"version\": \"${canonical}\""
+  # serverInfo.version returned by the MCP `initialize` handshake. A client
+  # reads the card and the handshake; they must agree.
+  "defaults/dot_local/share/dot-mcp/main.go|^const version =|const version = \"${canonical}\""
+  # LLM-facing repo index.
+  "llms.txt|Current version:|Current version: v${canonical}."
+  # Citation metadata: a stale version here is cited in papers.
+  "CITATION.cff|^version:|version: ${canonical}"
+  # Keep-a-Changelog: the top heading must be the version being shipped.
+  "CHANGELOG.md|^## v|## v${canonical}"
+)
+
+drift=0
+for spec in "${specs[@]}"; do
+  IFS='|' read -r path pattern expected <<<"$spec"
+  if [[ ! -f "$path" ]]; then
+    _err "MISSING: $path (declared in spec list)"
+    drift=$((drift + 1))
+    continue
+  fi
+  line="$(grep -E "$pattern" "$path" | head -1 || true)"
+  if [[ -z "$line" ]]; then
+    _err "PATTERN NOT FOUND: '$pattern' in $path"
+    drift=$((drift + 1))
+    continue
+  fi
+  if [[ "$line" != *"$expected"* ]]; then
+    _err "DRIFT in $path"
+    _err "  found:    $line"
+    _err "  expected: contains '$expected'"
+    drift=$((drift + 1))
+    if ((fix)); then
+      # Auto-fix: only safe when the file contains a previous v0.X.YYY
+      # we can sed-replace. Skip otherwise.
+      old="$(printf '%s' "$line" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
+      if [[ -n "$old" ]] && [[ "$old" != "v${canonical}" ]]; then
+        sed -i.bak "s|${old}|v${canonical}|g" "$path" && rm -f "$path.bak"
+        _log "  fixed:  $path  ($old → v${canonical})"
+      fi
+    fi
+  fi
+done
+
+if ((drift > 0)); then
+  if ((fix)); then
+    _log ""
+    _log "Auto-fixed where safe. Re-run without --fix to verify."
+  else
+    _log ""
+    _log "Tip: rerun with --fix to auto-correct (only safe substitutions)."
+    _log "     For non-trivial drift, edit the file manually then re-run."
+  fi
+  exit 1
+fi
+
+_log "all $((${#specs[@]})) live version surfaces match $canonical"
+exit 0

package/scripts/version-sync.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 # Copyright (c) 2015-2026 Sebastien Rousseau
 # Version Synchronization Script
 # Synchronizes version numbers across all markdown files with package.json
@@ -39,12 +39,18 @@ EXCLUDE_FILES=(
   # carry per-release hash tables / closed-cycle logs. The "current"
   # version inside these is tracked by hand, not by version-sync.
   "docs/security/CI_PINNING.md"
+  # Same reason: supply-chain/README.md pins the SLSA generator at its
+  # required tag (v2.1.0). That is a third-party version, not ours.
+  "supply-chain/README.md"
   "docs/security/INSTALL_VERIFICATION.md"
   "docs/security/SCORECARD.md"
 
   # Release-verification recipes use an example pinned tag
   # that intentionally stays at a known-published release.
   "docs/security/VERIFY_RELEASE.md"
+  # Same category: pkg/VERIFY.md's "coverage by release" table names
+  # the release each attestation first appeared in, which is history.
+  "pkg/VERIFY.md"
 
   # Example bundles — version refs in README'd examples are illustrative.
   "examples/mise-plugin-dot/README.md"
@@ -287,7 +293,7 @@ update_version_references() {
     files_processed=$((files_processed + 1))
 
     # Skip milestone and other historical files
-    if [[ "$(basename "$file")" == MILESTONE_* ]]; then
+    if _is_historical_record "$file"; then
       log_info "Skipping historical file: $file"
       continue
     fi
@@ -366,6 +372,22 @@ update_version_references() {
   echo "$changes_made"
 }
 
+# A version reference is only drift if it is meant to track the release. In a
+# historical record it is evidence: GOLD-STANDARD-AUDIT.md records which tag
+# `git tag -v` was run against and what it printed, and MILESTONE_* files
+# describe releases that already happened. Rewriting either to the version
+# being prepared would claim a verification nobody performed against a tag
+# that does not exist yet, which is a worse outcome than a stale-looking
+# string. Both the updater and the verifier consult this, so they cannot
+# disagree about which files are in scope.
+_is_historical_record() {
+  case "$(basename "$1")" in
+    MILESTONE_*) return 0 ;;
+    GOLD-STANDARD-AUDIT.md) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 verify_version_consistency() {
   local expected_version="$1"
   local files=("${@:2}")
@@ -380,7 +402,7 @@ verify_version_consistency() {
       continue
     fi
 
-    if [[ "$(basename "$file")" == MILESTONE_* ]]; then
+    if _is_historical_record "$file"; then
       log_info "Skipping historical file: $file"
       continue
     fi
@@ -590,6 +612,11 @@ main() {
     "install.sh"
     "lib/dot/bento.sh"
     "share/man/man1/dot.1"
+    # The MCP server reports this string as serverInfo.version in the
+    # `initialize` handshake, and it must equal the version in
+    # .well-known/mcp/server-card.json — a client compares them.
+    # TestVersionMatchesServerCard fails the build if this drifts.
+    "defaults/dot_local/share/dot-mcp/main.go"
   )
   for script_file in "${script_files[@]}"; do
     local full_path="$PROJECT_ROOT/$script_file"
@@ -613,6 +640,39 @@ main() {
     fi
   done
 
+  # Machine-readable discovery cards. These are JSON with a bare
+  # `"version"` key, so the `v$VERSION` substitution above does not
+  # reach them — which is exactly why the MCP card sat at 0.2.501
+  # while the project shipped 0.2.519. Agents fetch these over the
+  # network, so a stale version here misroutes tooling rather than
+  # merely reading wrong. Gated by scripts/verify-release-versions.
+  local card_files=(
+    ".well-known/mcp/server-card.json"
+    ".well-known/agent-card.json"
+  )
+  for card_file in "${card_files[@]}"; do
+    local card_path="$PROJECT_ROOT/$card_file"
+    [[ -f "$card_path" ]] || continue
+    # Deliberately sed, not jq: jq re-serialises the whole document and
+    # would reflow the hand-formatted arrays in these cards, producing a
+    # large diff for a one-token change. Only the top-level "version"
+    # key is rewritten (it is the first such key in both files).
+    local card_tmp
+    card_tmp=$(umask 077 && mktemp)
+    cp "$card_path" "$card_tmp"
+    sed_in_place "$card_tmp" \
+      "1,6s|\"version\": \"$SED_VERSION_PATTERN\"|\"version\": \"$target_version\"|"
+    if ! cmp -s "$card_path" "$card_tmp"; then
+      if [[ "$dry_run" == "true" ]]; then
+        log_info "Would update: $card_file"
+      else
+        cat "$card_tmp" >"$card_path"
+        log_success "Updated: $card_file"
+      fi
+    fi
+    rm -f "$card_tmp"
+  done
+
   # Update version references
   local changes_made
   changes_made="$(update_version_references "$target_version" "$dry_run" "${version_files[@]}")"

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2015-2026 Sebastien Rousseau
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.