A Real Release Checked With rmqa, ukue 0.1.0 From GitHub

The other use cases on this site use a made-up tool so the mistakes can be planted on purpose. This one is a real release: ukue, a job queue that lives in one SQLite file, published on GitHub as five archives and a checksums file. Like rmqa, it’s a SoftDevStudio.com project, and its releases are built by a workflow nobody watches.

Writing the Manifest

The files came straight from the release’s download links. Then:

rmqa init ukue-0.1.0


project = "ukue"

[[platform]]
os = "darwin"
arch = "amd64"

[[platform]]
os = "darwin"
arch = "arm64"

[[platform]]
os = "linux"
arch = "amd64"

[[platform]]
os = "linux"
arch = "arm64"

[[platform]]
os = "windows"
arch = "amd64"

[[artifact]]
name = "SHA256SUMS"
checksums = "sha256"

[[artifact]]
name = "ukue_{os}_{arch}.{archive}"
binaries = ["ukue{exe}"]
files = ["LICENSE", "NOTICE", "README.md", "THIRD_PARTY_LICENSES.md"]
run = ["version"]

rmqa found the ukue program in each archive, read the platform from its header, matched the platform words in the file names, and noticed that every archive also carries LICENSE, NOTICE, README.md and THIRD_PARTY_LICENSES.md. ukue’s archive names have no version in them, on purpose, so links to the latest release never change; the manifest has no version either, and it comes from the command line instead. The one line added by hand is run = ["version"], because ukue version prints the version.

The Check

$ rmqa check ukue-0.1.0 --manifest ukue.toml --version 0.1.0
Checking ukue-0.1.0 for ukue 0.1.0

  ok    SHA256SUMS
  ok    ukue_darwin_amd64.tar.gz  darwin/amd64
  ok    ukue_darwin_arm64.tar.gz  darwin/arm64
  ok    ukue_linux_amd64.tar.gz   linux/amd64
  ok    ukue_linux_arm64.tar.gz   linux/arm64
  ok    ukue_windows_amd64.zip    windows/amd64

Ready to publish: 0 errors, 0 warnings in 6 files.

rmqa checking the five archives and the checksums file of the real ukue 0.1.0 release: every file passes.

Every file passes. Under that one word per file, rmqa opened five archives, identified five programs as ELF for Linux on Intel and ARM, Mach-O for macOS on Apple silicon and Intel, and PE for Windows, found 0.1.0 inside each, ran the Linux Intel build and read ukue 0.1.0 back, checked the executable bit on the four Unix programs, found the four documentation files in every archive, and matched all five archives against SHA256SUMS.

And the Same Release Against the Wrong Version

To see the check bite on real files, ask for a version the release doesn’t carry:

$ rmqa check ukue-0.1.0 --manifest ukue.toml --version 0.1.1
Checking ukue-0.1.0 for ukue 0.1.1

  ok    SHA256SUMS
  FAIL  ukue_darwin_amd64.tar.gz  darwin/amd64
          ukue: doesn't contain the version string 0.1.1; it may be an old build [version-missing]
  FAIL  ukue_darwin_arm64.tar.gz  darwin/arm64
...

That’s the report a team would get if the version had been raised for a new release but one of the archives still held the old build.

The manifest is in rmqa’s repository as examples/ukue.toml, and rmqa’s recorded test results include this check against the live release, run again every time the results are recorded.