fix: keep release credentials out of public remote URLs

CHANGELOG.md

@@ -6,6 +6,7 @@
 
 - Cuprate is presented as one user-facing app in My Apps, including its UI launch button; the generated dashboard companion is hidden as an implementation detail instead of appearing under Services.
 - Added regression coverage for Cuprate install and installed-state grouping.
+- Release validation was rerun on the corrected tree before OTA and ISO publication.
 
 ## v1.8.14-alpha (2026-09-13)
 

release-manifest.json

@@ -1,30 +1,29 @@
 {
   "changelog": [
-    "**Cuprate gains a first-party companion dashboard.** The Monero node now has a Bitcoin-style status UI, safe app grouping, a 450 GB disk-safety gate, and a restricted RPC that is never exposed as a launch page.",
+    "Cuprate is presented as one user-facing app in My Apps, including its UI launch button; the generated dashboard companion is hidden as an implementation detail instead of appearing under Services.",
-    "**Bitcoin Core Tor enrollment uses the correct protocol identity.** `bitcoin-core` is forwarded on port 8333 and resolves to its own hidden-service directory without disturbing legacy Bitcoin aliases.",
+    "Added regression coverage for Cuprate install and installed-state grouping.",
-    "**GitWorkshop opens Archipelago’s canonical ngit repository by default.** The launcher and registry promotion use the full maintainer/relay/`archy` coordinate, with regression coverage for Companion and browser-tab launches.",
+    "Release validation was rerun on the corrected tree before OTA and ISO publication."
-    "**Release validation is stricter.** The registry gate now checks the complete canonical source deep link, and the merged candidate passed the full frontend and focused backend test suites."
   ],
   "components": [
     {
-      "current_version": "1.8.14-alpha",
+      "current_version": "1.8.15-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.14-alpha/archipelago",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.15-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.8.14-alpha",
+      "new_version": "1.8.15-alpha",
-      "sha256": "3d8e5e7c79a261649e89c4f5ba8d90db9057ebbb002919a812ca82f664b315bf",
+      "sha256": "3eee71563337f20cb348529925c58b8227afec796783a69176e0b59b9e113c91",
-      "size_bytes": 64568360
+      "size_bytes": 64571544
     },
     {
-      "current_version": "1.8.14-alpha",
+      "current_version": "1.8.15-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.14-alpha/archipelago-frontend-1.8.14-alpha.tar.gz",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.15-alpha/archipelago-frontend-1.8.15-alpha.tar.gz",
-      "name": "archipelago-frontend-1.8.14-alpha.tar.gz",
+      "name": "archipelago-frontend-1.8.15-alpha.tar.gz",
-      "new_version": "1.8.14-alpha",
+      "new_version": "1.8.15-alpha",
-      "sha256": "e1c490e52571bf9238435e5986792c6bd602fd7e398783546f7592aa921d3386",
+      "sha256": "86a32ef3334b03c197e47d9d28f4435c6f2fa7c4ccacc839a8fc4a0a749495dc",
-      "size_bytes": 98792963
+      "size_bytes": 98797600
     }
   ],
   "release_date": "2026-09-13",
-  "signature": "dacfdd2707e415af8a42306a63658a7d41cdfeba29d43802d465d18f00a747ecbfa54ea4ee8ed1eedf94d4f30371453fd9c9d475af9d6a62eac4e2c8e783b405",
+  "signature": "5e13396e2f33571f136bb1a9ea0356486b3d42c6ba99ee5d33990cd565d9b1178f61eaf6a70a937a006e7de3fd388bcebd63f2daca4bb28accc1b810d8455d03",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.8.14-alpha"
+  "version": "1.8.15-alpha"
 }

releases/manifest.json

@@ -1,30 +1,29 @@
 {
   "changelog": [
-    "**Cuprate gains a first-party companion dashboard.** The Monero node now has a Bitcoin-style status UI, safe app grouping, a 450 GB disk-safety gate, and a restricted RPC that is never exposed as a launch page.",
+    "Cuprate is presented as one user-facing app in My Apps, including its UI launch button; the generated dashboard companion is hidden as an implementation detail instead of appearing under Services.",
-    "**Bitcoin Core Tor enrollment uses the correct protocol identity.** `bitcoin-core` is forwarded on port 8333 and resolves to its own hidden-service directory without disturbing legacy Bitcoin aliases.",
+    "Added regression coverage for Cuprate install and installed-state grouping.",
-    "**GitWorkshop opens Archipelago’s canonical ngit repository by default.** The launcher and registry promotion use the full maintainer/relay/`archy` coordinate, with regression coverage for Companion and browser-tab launches.",
+    "Release validation was rerun on the corrected tree before OTA and ISO publication."
-    "**Release validation is stricter.** The registry gate now checks the complete canonical source deep link, and the merged candidate passed the full frontend and focused backend test suites."
   ],
   "components": [
     {
-      "current_version": "1.8.14-alpha",
+      "current_version": "1.8.15-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.14-alpha/archipelago",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.15-alpha/archipelago",
       "name": "archipelago",
-      "new_version": "1.8.14-alpha",
+      "new_version": "1.8.15-alpha",
-      "sha256": "3d8e5e7c79a261649e89c4f5ba8d90db9057ebbb002919a812ca82f664b315bf",
+      "sha256": "3eee71563337f20cb348529925c58b8227afec796783a69176e0b59b9e113c91",
-      "size_bytes": 64568360
+      "size_bytes": 64571544
     },
     {
-      "current_version": "1.8.14-alpha",
+      "current_version": "1.8.15-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.14-alpha/archipelago-frontend-1.8.14-alpha.tar.gz",
+      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.15-alpha/archipelago-frontend-1.8.15-alpha.tar.gz",
-      "name": "archipelago-frontend-1.8.14-alpha.tar.gz",
+      "name": "archipelago-frontend-1.8.15-alpha.tar.gz",
-      "new_version": "1.8.14-alpha",
+      "new_version": "1.8.15-alpha",
-      "sha256": "e1c490e52571bf9238435e5986792c6bd602fd7e398783546f7592aa921d3386",
+      "sha256": "86a32ef3334b03c197e47d9d28f4435c6f2fa7c4ccacc839a8fc4a0a749495dc",
-      "size_bytes": 98792963
+      "size_bytes": 98797600
     }
   ],
   "release_date": "2026-09-13",
-  "signature": "dacfdd2707e415af8a42306a63658a7d41cdfeba29d43802d465d18f00a747ecbfa54ea4ee8ed1eedf94d4f30371453fd9c9d475af9d6a62eac4e2c8e783b405",
+  "signature": "5e13396e2f33571f136bb1a9ea0356486b3d42c6ba99ee5d33990cd565d9b1178f61eaf6a70a937a006e7de3fd388bcebd63f2daca4bb28accc1b810d8455d03",
   "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.8.14-alpha"
+  "version": "1.8.15-alpha"
 }

releases/pending/v1.8.15-alpha/manifest.json

@@ -1,28 +0,0 @@
-{
-  "changelog": [
-    "Cuprate is presented as one user-facing app in My Apps, including its UI launch button; the generated dashboard companion is hidden as an implementation detail instead of appearing under Services.",
-    "Added regression coverage for Cuprate install and installed-state grouping."
-  ],
-  "components": [
-    {
-      "current_version": "1.8.15-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.15-alpha/archipelago",
-      "name": "archipelago",
-      "new_version": "1.8.15-alpha",
-      "sha256": "3eee71563337f20cb348529925c58b8227afec796783a69176e0b59b9e113c91",
-      "size_bytes": 64571544
-    },
-    {
-      "current_version": "1.8.15-alpha",
-      "download_url": "https://source.archipelago-foundation.org/lfg2025/archy/releases/download/v1.8.15-alpha/archipelago-frontend-1.8.15-alpha.tar.gz",
-      "name": "archipelago-frontend-1.8.15-alpha.tar.gz",
-      "new_version": "1.8.15-alpha",
-      "sha256": "41ad8a2ec3f3338f66a5ffffecbbf23872a61524cd0c64d7b392e00b9b40576b",
-      "size_bytes": 98798913
-    }
-  ],
-  "release_date": "2026-09-13",
-  "signature": "9b4c074e5014ea940e58b3a195c9da90f975f0664c93b9576db3055cff8cb09e59b2ffbdb2f48e407e9890afaf3ca03d28f257ede925387b5ffb30ffb688b00d",
-  "signed_by": "did:key:z6Mkfu5LT8d4DjETtrkATvHh9Dvcbnr7zBCUwfau8Sw7DLWT",
-  "version": "1.8.15-alpha"
-}

scripts/publish-release-assets.sh

@@ -53,24 +53,33 @@ if [ -x "$PROJECT_ROOT/core/target/release/archipelago" ]; then
 fi
 
 remote_url=$(git -C "$PROJECT_ROOT" remote get-url "$REMOTE")
-# https is accepted as well as http. Requiring http:// meant the only remote
+# Remote URLs are public metadata: ngit can include them in repository
-# whose credential actually works for git push (the https one) was rejected,
+# announcements. Keep credentials in Git's credential helper, never in URLs.
-# while the http remote it forced you to use had a dead token — so publishing
-# failed on auth after the manifest had already passed every check
-# (v1.7.121-alpha, 2026-08-04). The scheme is carried through to the API URL
-# rather than assumed.
 case "$remote_url" in
-    http://*@*|https://*@*) ;;
+    http://*@*|https://*@*) fail "$REMOTE embeds credentials; move them to a Git credential helper and remove them from the remote URL" ;;
-    *) fail "$REMOTE must be an authenticated http(s):// Gitea remote URL for API uploads" ;;
+    http://*|https://*) ;;
+    *) fail "$REMOTE must be an http(s):// Gitea remote URL for API uploads" ;;
 esac
 
 scheme=${remote_url%%://*}
-rest=${remote_url#*://}
+host_path=${remote_url#*://}
-auth=${rest%%@*}
-host_path=${rest#*@}
 host=${host_path%%/*}
 repo_path=${host_path#*/}
 repo_path=${repo_path%.git}
+credential=$(printf 'url=%s\n\n' "$remote_url" | GIT_TERMINAL_PROMPT=0 git -C "$PROJECT_ROOT" credential fill) \
+    || fail "no Git credential available for $REMOTE; configure a credential helper first"
+auth_user=""
+auth_password=""
+while IFS= read -r field; do
+    case "$field" in
+        username=*) auth_user=${field#username=} ;;
+        password=*) auth_password=${field#password=} ;;
+    esac
+done <<< "$credential"
+[ -n "$auth_user" ] && [ -n "$auth_password" ] \
+    || fail "Git credential helper did not provide a username and password for $REMOTE"
+auth="$auth_user:$auth_password"
+unset credential auth_user auth_password
 api="$scheme://$host/api/v1/repos/$repo_path"
 release_url="$api/releases/tags/v${VERSION}"