gitbash 3.0.0 → 3.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/bin/gitbash +2 -1
- package/docs/SECURITY.md +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -76,7 +76,7 @@ curl -fsSL https://raw.githubusercontent.com/jaggli/gitbash/main/install.sh | sh
|
|
|
76
76
|
irm https://raw.githubusercontent.com/jaggli/gitbash/main/install.ps1 | iex
|
|
77
77
|
```
|
|
78
78
|
|
|
79
|
-
It installs to `~/.local/share/gitbash` and links `~/.local/bin/gitbash` (add that folder to your PATH if the script says so); delete both to uninstall. Set `GITBASH_VERSION` for a specific version, and `GITBASH_INSTALL_DIR` / `GITBASH_BIN_DIR` for other locations.
|
|
79
|
+
It downloads the package published on npm, checks it against npm's sha512 checksum, and installs it to `~/.local/share/gitbash` and links `~/.local/bin/gitbash` (add that folder to your PATH if the script says so); delete both to uninstall. Set `GITBASH_VERSION` for a specific version, and `GITBASH_INSTALL_DIR` / `GITBASH_BIN_DIR` for other locations.
|
|
80
80
|
|
|
81
81
|
## Options
|
|
82
82
|
|
package/bin/gitbash
CHANGED
|
@@ -396,7 +396,8 @@ check_pwsh_integration() {
|
|
|
396
396
|
# Restricted (the default of Windows PowerShell) and AllSigned block the profile
|
|
397
397
|
case "$policy" in
|
|
398
398
|
Restricted|AllSigned|Undefined)
|
|
399
|
-
|
|
399
|
+
# A security setting: never changed by pressing Enter or by GITBASH_ASSUME_YES
|
|
400
|
+
if gb_confirm --strict "PowerShell blocks scripts, including your profile ($policy). Allow local scripts (execution policy RemoteSigned)?" n; then
|
|
400
401
|
if "$exe" -NoProfile -NonInteractive -Command 'Set-ExecutionPolicy -Scope CurrentUser RemoteSigned -Force'; then
|
|
401
402
|
print_success "Local scripts allowed."
|
|
402
403
|
else
|
package/docs/SECURITY.md
CHANGED
|
@@ -28,6 +28,7 @@ Versions before 2.0 executed repository `.gitbashrc` files as shell code, so ope
|
|
|
28
28
|
## Releases
|
|
29
29
|
|
|
30
30
|
- Releases are staged only by the Release workflow in GitHub Actions, with npm trusted publishing (OIDC, no long-lived npm token) and [provenance](https://docs.npmjs.com/generating-provenance-statements). A version goes live only after a maintainer approves it with 2FA ([staged publishing](https://docs.npmjs.com/staged-publishing/)); neither the workflow nor a leaked GitHub token can publish on its own. Check an installed copy with `npm audit signatures`.
|
|
31
|
+
- The install script (`install.sh`, also used by `gitbash --update` for script installs) downloads that same npm package and installs it only if it matches the sha512 checksum npm records for the version, so a moved git tag cannot change what gets installed.
|
|
31
32
|
- The npm package is published before the GitHub release, which `gitbash --update` and the install script use.
|
|
32
33
|
- Third-party actions are pinned to commit SHAs and kept up to date by Dependabot; each workflow job gets only the permissions it needs.
|
|
33
34
|
|