Be open about where the script comes from instead of showing a checksum #6

Merged

jacboy merged 1 commit from claude/lucid-planck-v4zwtb into master

2026-11-09 16:31:55 +00:00

jacboy commented

2026-11-09 16:30:54 +00:00

(Migrated from github.com)

This commit was pushed to the branch of jacboy/sysperf#5 just after that PR was merged, so it never reached master. This PR brings it in, rebased onto the current master.

Why

The landing page showed the SHA-256 of /bench as a trust signal. But the checksum came from the same server as the script: whoever could replace one could replace both. So it only proved the transfer, not the origin.

Changes

Landing page: "Before you run it"

Says where the script comes from: the exact commit of github.com/jacboy/sysperf the site is built from, with links to that version of bench and to its full change history. The download-read-run command stays.
Offers an independent check: one diff of the script from getsysperf.com against the same commit on raw.githubusercontent.com. These are two independent sources, so to hand someone a different script, an attacker would have to compromise both.
Says what that proves and what it doesn't: it shows the site serves what is public on GitHub, nothing more. Whether to trust the code is the reader's call.

The footer also shows the commit. /bench.sha256 is still published for scripts, but no longer presented as a security feature.

`site/build.sh`

Takes the commit from GITHUB_SHA (in Actions) or git rev-parse HEAD.
Refuses to build when bench differs from that commit, so the page can't name a commit it isn't serving.

README

Instead of the checksum link, the same comparison command, against master, with a note that the two can briefly differ right after a push.

Testing

Comparison command:
- Copied verbatim from the built page and run against the live site: prints identical.
- A modified copy is reported as different.
- The README variant against master also prints identical.
Build:
- With an uncommitted change to bench, build.sh stops with "bench differs from commit …".
- After the rebase, the build succeeds with no placeholders left.
Page: Chromium at 1280 px (dark) and 375 px (light): no horizontal overflow, no console errors or CSP violations.

After merging

The Deploy site workflow publishes the new section. The commit shown on the page will be the merge commit, whose bench is identical to the one served.

Generated by Claude Code

This commit was pushed to the branch of jacboy/sysperf#5 just after that PR was merged, so it never reached `master`. This PR brings it in, rebased onto the current `master`. ## Why The landing page showed the SHA-256 of `/bench` as a trust signal. But the checksum came from the same server as the script: whoever could replace one could replace both. So it only proved the transfer, not the origin. ## Changes ### Landing page: "Before you run it" 1. **Says where the script comes from:** the exact commit of `github.com/jacboy/sysperf` the site is built from, with links to that version of `bench` and to its full change history. The download-read-run command stays. 2. **Offers an independent check:** one `diff` of the script from `getsysperf.com` against the same commit on `raw.githubusercontent.com`. These are two independent sources, so to hand someone a different script, an attacker would have to compromise both. 3. **Says what that proves and what it doesn't:** it shows the site serves what is public on GitHub, nothing more. Whether to trust the code is the reader's call. The footer also shows the commit. `/bench.sha256` is still published for scripts, but no longer presented as a security feature. ### `site/build.sh` - Takes the commit from `GITHUB_SHA` (in Actions) or `git rev-parse HEAD`. - **Refuses to build when `bench` differs from that commit**, so the page can't name a commit it isn't serving. ### README Instead of the checksum link, the same comparison command, against `master`, with a note that the two can briefly differ right after a push. ## Testing - **Comparison command:** - Copied verbatim from the built page and run against the live site: prints `identical`. - A modified copy is reported as different. - The README variant against `master` also prints `identical`. - **Build:** - With an uncommitted change to `bench`, `build.sh` stops with "bench differs from commit …". - After the rebase, the build succeeds with no placeholders left. - **Page:** Chromium at 1280 px (dark) and 375 px (light): no horizontal overflow, no console errors or CSP violations. ## After merging The *Deploy site* workflow publishes the new section. The commit shown on the page will be the merge commit, whose `bench` is identical to the one served. --- _Generated by [Claude Code](https://claude.ai/code/session_01WFUVi2gu5nYSuZeyRWAGiM)_