mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5
66533e6b50
A vendor that ships a package file but runs no repository left the registry nothing to resolve, so cursor declared an empty list on Debian and RedHat and the role deployed while installing nothing. The new 'download' source names the artefact directly and pins it by digest: the URL alone would install whatever the vendor serves today. get_url verifies before and after the transfer, the artefact is cached root-owned so no other account can swap it in the window before the install, and a closing package call fails loudly when the artefact registered under a name other than the one declared. Cursor's rpm carries no signature, which is why dnf runs with disable_gpg_check; the digest is the integrity control. All 92 of its requirements resolve against Fedora 44 and CentOS Stream 10 repodata. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>