ultra-v0.6.8 C4, the diagnostic half: the installer's fetch failure in site-src/install.sh.tmpl said only 'check the network', so on a host that reaches GitHub through HTTPS_PROXY or finds its CA bundle through SSL_CERT_FILE — both deliberately unset by the GHSA-x4v8-rxvx-8v89 lockdown — the cause was misdiagnosed. The message now names the variables the installer ignores (both cases of the proxy names) and says how to install by hand; the lockdown itself and whether to offer an escape from it stay with iss-2608291814562032.

Frontmatter

.abcd/work/issues/resolved/iss-2608291941067275-installer-failure-message-does-not-name.md
open on GitHub ↗ · commit history ↗

mentions1

• iss-2608291814562032ultra-v0.6.8 C4 (capture only): site-src/install.sh.tmpl unconditionally unsets the proxy and CA-bundle variables (HTTPS_PROXY, ALL_PROXY, CURL_CA_BUNDLE, SSL_CERT_FILE, SSL_CERT_DIR, CURL_HOME) before any fetch. The lockdown IS the GHSA-x4v8-rxvx-8v89 fix and hooks/bootstrap.sh mirrors it, so it is deliberate; the cost is that a host whose curl finds its CA bundle only through SSL_CERT_FILE (NixOS, minimal containers, custom OpenSSL) or a network reachable only through HTTPS_PROXY cannot install, and the generic could-not-download message does not say why. The review proposes an explicit escape such as ABCD_INSTALL_KEEP_ENV=1; the objection is that an environment-variable opt-out reopens the very vector the lockdown closes (the poisoned environment sets the escape too). Whether to trade the lockdown for those users is a product decision, not a code fix. The purely diagnostic part — naming the ignored variables in the failure message — does not weaken the lockdown.