karnel-termux 4.17.31 → 4.17.32

package/README.md

@@ -8,7 +8,7 @@
 
 <p align="center">
   <a href="https://github.com/israelmarques1024-dotcom/karnel-termux">
-    <img src="https://img.shields.io/badge/version-4.17.31-0078D4?style=for-the-badge" alt="Version">
+    <img src="https://img.shields.io/badge/version-4.17.32-0078D4?style=for-the-badge" alt="Version">
   </a>
   <a href="https://www.npmjs.com/package/karnel-termux">
     <img src="https://img.shields.io/npm/v/karnel-termux?style=for-the-badge&logo=npm&color=cb3837" alt="npm">
@@ -78,7 +78,7 @@ Why it's great:
 ### Via checksummed GitHub release (recommended)
 
 ```bash
-version=4.17.31
+version=4.17.32
 tmpdir=$(mktemp -d) && trap 'rm -rf "$tmpdir"' EXIT
 base="https://github.com/israelmarques1024-dotcom/karnel-termux/releases/download/v$version"
 curl -fsSL "$base/karnel-termux-install.sh" -o "$tmpdir/karnel-termux-install.sh"

package/karnel/RELEASE_COMMIT

@@ -1 +1 @@
-385a0757314adc4d9fdd8d005fb42b6f8b5c29d1
+055ef02ecb9f9ddd5bf909126730a5c00e2f09ee

package/karnel/utils/install.sh

@@ -201,8 +201,21 @@ activate_installer_file() {
 
 github_release_asset_sha256() {
   local repo="$1" version="$2" asset="$3" digest=""
-  # GitHub's release API does not expose per-asset digests, so fetch the
-  # companion checksum file published alongside the asset (common convention).
+  # Modern GitHub releases expose an official SHA-256 in each asset's digest
+  # field. Prefer it so installers do not depend on companion checksum files.
+  if command -v jq >/dev/null 2>&1; then
+    digest=$(curl -fsSL --connect-timeout 10 --max-time 30 \
+      -H 'Accept: application/vnd.github+json' \
+      "https://api.github.com/repos/$repo/releases/tags/$version" 2>/dev/null \
+      | jq -r --arg asset "$asset" '.assets[] | select(.name == $asset) | .digest // empty' 2>/dev/null \
+      | awk -F: 'NR == 1 { print $NF }' | tr -d '\r')
+    if [[ "$digest" =~ ^[0-9a-f]{64}$ ]]; then
+      echo "$digest"
+      return 0
+    fi
+  fi
+  # Older GitHub releases may not have an API digest. Try the companion
+  # checksum file published alongside the asset (a common convention).
   digest=$(curl -fsSL --connect-timeout 10 --max-time 30 \
     "https://github.com/$repo/releases/download/$version/$asset.sha256" 2>/dev/null \
     | awk '{print $1; exit}' | tr -d '\r')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karnel-termux",
-  "version": "4.17.31",
+  "version": "4.17.32",
   "description": "Modular Dev Environment for Termux — install languages, databases, AI agents, editors, and more with one command",
   "bin": {
     "karnel": "karnel/bin/karnel"