Github API /repos/<repo>/releases/latest not working

[pierwill]

I am trying to get the number of the latest rustup release with the following:

curl --silent "https://api.github.com/repos/rust-lang/rustup/releases/latest" | # Get latest release from GitHub api
    grep '"tag_name":' |                                                 # Get tag line
    sed -E 's/.*"([^"]+)".*/\1/'                                         # Pluck JSON value

This is currently not working with the rustup repository, although it does work with rust-lang/rust:

$ curl --silent "https://api.github.com/repos/rust-lang/rust/releases/latest" | 
    grep '"tag_name":' |                                           
    sed -E 's/.*"([^"]+)".*/\1/'                                   
1.53.0

This API would be great to have enabled for this repository!

[rbtcollins]

Can I ask what you are trying to accomplish@

[pierwill]

I'm looking here: https://gist.github.com/lukechilds/a83e1d7127b78fef38c2914c4ececc3c

Turns out the tags endpoint does work:

curl --silent "https://api.github.com/repos/rust-lang/rustup/tags" |\
  grep '"name":' |\
  sed -E 's/.*"([^"]+)".*/\1/' |\
  head -n 1

[pierwill]

Example script:

get_latest_release() {
    curl --silent "https://api.github.com/repos/rust-lang/rustup/tags" |\
        grep '"name":' |\
        sed -E 's/.*"([^"]+)".*/\1/' |\
        head -n 1
}

RUSTUP_VERSION=1.24.3
RUSTUP_LATEST_VERSION="$(get_latest_release)"
OUR_RUSTUP_SHA="a3cb081f88a6789d104518b30d4aa410009cd08c3822a1226991d6cf0442a0f8"

if [ $RUSTUP_VERSION != $RUSTUP_LATEST_VERSION ]; then
    echo "${RUSTUP_VERSION} is not the latest rustup version (${RUSTUP_LATEST_VERSION})"
    exit 1
fi

curl --proto '=https' --tlsv1.2 -sSf -O \
  https://raw.githubusercontent.com/rust-lang/rustup/${RUSTUP_VERSION}/rustup-init.sh

echo "${OUR_RUSTUP_SHA}  rustup-init.sh" | sha256sum --check --

[rbtcollins]

It still isn't clear why you need this. Rustup self updates.

…

On Tue, 13 Jul 2021, 19:40 pierwill, ***@***.***> wrote: Example script: get_latest_release() { curl --silent "https://api.github.com/repos/rust-lang/rustup/tags" |\ grep '"name":' |\ sed -E 's/.*"([^"]+)".*/\1/' |\ head -n 1 } RUSTUP_VERSION=1.24.2 RUSTUP_LATEST_VERSION="$(get_latest_release)" OUR_RUSTUP_SHA="a3cb081f88a6789d104518b30d4aa410009cd08c3822a1226991d6cf0442a0f8" if [ $RUSTUP_VERSION != $RUSTUP_LATEST_VERSION ]; then echo "${RUSTUP_VERSION} is not the latest rustup version (${RUSTUP_LATEST_VERSION})" exit 1 fi curl --proto '=https' --tlsv1.2 -sSf -O \ https://raw.githubusercontent.com/rust-lang/rustup/${RUSTUP_VERSION}/rustup-init.sh echo "${OUR_RUSTUP_SHA} rustup-init.sh" | sha256sum --check -- — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2824 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADZ7XV6AB6YYU2A54CKCI3TXR3AZANCNFSM5AJTCCAA> .

[kinnison]

What problem are you trying to solve @pierwill ? Note, I'm not asking what you're trying to do, since that's pretty clear. I'm trying to work out why and what problem you're trying to solve, in case there's an easier way we can do that.

[pierwill]

I've been working on ways to increase security when using rustup in environments like CI/CD, where we want to use a specific version of the install script and verify its checksum. As part of this, it might be nice to add a check/notification when a new version of the install script is available (i.e., a new rustup release), hence the call to the Github API. I thought there was a chance others might want to do something similar, so I figured I'd open the issue here. :)

[kinnison]

I can find no setting about this, do you know where the config would be? Is it possible you need an API token which has rust-lang access to use that API?

[jyn514]

@pierwill rustup uses tags, not 'releases'. I think releases are a github thing and aren't tied into git. @pietroalbini set this up for rust-lang/rust in rust-lang/rust#76516, so it looks like you can configure triagebot to sync it automatically.

[pietroalbini]

Yes, but triagebot doesn't support this style of changelog yet (which seems https://keepachangelog.com/en/1.0.0/). It'd need to be added to https://github.com/rust-lang/triagebot/tree/master/src/changelogs first.