Point to getsysperf.com, be open about the script's origin, fix deploy verification #5

Merged

jacboy merged 1 commit from claude/lucid-planck-v4zwtb into master

2026-11-09 15:29:14 +00:00

jacboy commented

2026-11-09 15:28:34 +00:00

(Migrated from github.com)

getsysperf.com is live on Cloudflare Pages. This PR switches the README to it, replaces the landing page's checksum with an honest way to check the script's origin, and fixes a false failure in the deploy workflow's verification step.

Changes

Landing page: "Before you run it"

The page used to show the SHA-256 of /bench as a trust signal. But the checksum came from the same server as the script: whoever could replace one could replace both. So it only proved the transfer, not the origin. The section now:

Says where the script comes from: the exact commit of github.com/jacboy/sysperf the site is built from, with links to that version of bench and to its full change history. The download-read-run command stays.
Offers an independent check: one diff of the script from getsysperf.com against the same commit on raw.githubusercontent.com. These are two independent sources, so to hand someone a different script, an attacker would have to compromise both.
Says what that proves and what it doesn't: it shows the site serves what is public on GitHub, nothing more. Whether to trust the code is the reader's call.

The footer also shows the commit. /bench.sha256 is still published for scripts, but no longer presented as a security feature.

`site/build.sh`

Takes the commit from GITHUB_SHA (in Actions) or git rev-parse HEAD.
Refuses to build when bench differs from that commit, so the page can't name a commit it isn't serving.

README

All one-liners and download commands use https://getsysperf.com/bench. The raw GitHub URL is still mentioned as an alternative.
Instead of the checksum link, the same comparison command, against master, with a note that the two can briefly differ right after a push.

`.github/workflows/deploy.yml`: verification step

The first run logged curl: (23) Failure writing output to destination. With curl … | grep -q, grep exits on the first match, curl then fails to write, and under GitHub's bash -eo pipefail the check could fail although the right version was live. The page is now fetched completely and then searched.

`site/README.md`

Removed the "after the domain is live" note.

Testing

Live site from a data-centre IP, with plain curl: /, /bench and /bench.sha256 return 200 on sysperf.pages.dev and getsysperf.com.
- /bench is text/plain, and byte-identical to master.
- The _headers headers are applied.
Comparison command:
- Copied verbatim from the built page and run against the live site: prints identical.
- A modified copy is reported as different.
- The README variant against master also prints identical.
Build safeguard: with an uncommitted change to bench, build.sh stops with "bench differs from commit …".
Page:
- Chromium at 1280 px (dark) and 375 px (light): no horizontal overflow, no console errors or CSP violations.
- No placeholders left in the build.
Verification step: run against both live addresses with bash --noprofile --norc -eo pipefail, as on GitHub, it passed on the first attempt.
actionlint passes.

About the 403 in the first run

getsysperf.com answered 403 to the first deploy run while sysperf.pages.dev worked. The custom domain had only just been added and its certificate was still being issued; minutes later the same requests return 200, including from a data-centre IP. If it shows up again from GitHub's runners, Cloudflare's bot protection (Bot Fight Mode / Browser Integrity Check) is the next thing to check, because sysperf's users also download from servers.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WFUVi2gu5nYSuZeyRWAGiM

`getsysperf.com` is live on Cloudflare Pages. This PR switches the README to it, replaces the landing page's checksum with an honest way to check the script's origin, and fixes a false failure in the deploy workflow's verification step. ## Changes ### Landing page: "Before you run it" The page used to show the SHA-256 of `/bench` as a trust signal. But the checksum came from the same server as the script: whoever could replace one could replace both. So it only proved the transfer, not the origin. The section now: 1. **Says where the script comes from:** the exact commit of `github.com/jacboy/sysperf` the site is built from, with links to that version of `bench` and to its full change history. The download-read-run command stays. 2. **Offers an independent check:** one `diff` of the script from `getsysperf.com` against the same commit on `raw.githubusercontent.com`. These are two independent sources, so to hand someone a different script, an attacker would have to compromise both. 3. **Says what that proves and what it doesn't:** it shows the site serves what is public on GitHub, nothing more. Whether to trust the code is the reader's call. The footer also shows the commit. `/bench.sha256` is still published for scripts, but no longer presented as a security feature. ### `site/build.sh` - Takes the commit from `GITHUB_SHA` (in Actions) or `git rev-parse HEAD`. - **Refuses to build when `bench` differs from that commit**, so the page can't name a commit it isn't serving. ### README - All one-liners and download commands use `https://getsysperf.com/bench`. The raw GitHub URL is still mentioned as an alternative. - Instead of the checksum link, the same comparison command, against `master`, with a note that the two can briefly differ right after a push. ### `.github/workflows/deploy.yml`: verification step The first run logged `curl: (23) Failure writing output to destination`. With `curl … | grep -q`, grep exits on the first match, curl then fails to write, and under GitHub's `bash -eo pipefail` the check could fail although the right version was live. The page is now fetched completely and then searched. ### `site/README.md` Removed the "after the domain is live" note. ## Testing - **Live site from a data-centre IP, with plain `curl`:** `/`, `/bench` and `/bench.sha256` return 200 on `sysperf.pages.dev` and `getsysperf.com`. - `/bench` is `text/plain`, and byte-identical to `master`. - The `_headers` headers are applied. - **Comparison command:** - Copied verbatim from the built page and run against the live site: prints `identical`. - A modified copy is reported as different. - The README variant against `master` also prints `identical`. - **Build safeguard:** with an uncommitted change to `bench`, `build.sh` stops with "bench differs from commit …". - **Page:** - Chromium at 1280 px (dark) and 375 px (light): no horizontal overflow, no console errors or CSP violations. - No placeholders left in the build. - **Verification step:** run against both live addresses with `bash --noprofile --norc -eo pipefail`, as on GitHub, it passed on the first attempt. - `actionlint` passes. ## About the 403 in the first run `getsysperf.com` answered `403` to the first deploy run while `sysperf.pages.dev` worked. The custom domain had only just been added and its certificate was still being issued; minutes later the same requests return 200, including from a data-centre IP. If it shows up again from GitHub's runners, Cloudflare's bot protection (Bot Fight Mode / Browser Integrity Check) is the next thing to check, because sysperf's users also download from servers. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01WFUVi2gu5nYSuZeyRWAGiM