Nasiko installation requires a pinned version such as v0.1.0

Error message

Nasiko installation requires a pinned version such as v0.1.0; latest is not allowed.

What it means

getQualifiedRelease in scripts/lib/nasiko-release.js requires an exact 'vMAJOR.MINOR.PATCH' version because every release's manifest and binary sha256 digests are pinned in QUALIFIED_RELEASES. The regex /^v\d+\.\d+\.\d+$/ rejects anything else before any platform work happens. This makes installs reproducible and immune to registry tag drift.

Source

Thrown at scripts/lib/nasiko-release.js:42

    'linux/arm64': Object.freeze({ manifestDigest: 'sha256:655021a129c7df4621a80d16ea4eab38018530bfe9a20da646641d9f4ac5c249', binaryDigest: 'sha256:85f9fa5cfbed6c276fce6df2d71e9d0c66d7d8e8d46a40297464833d38db7a7e' }),
    'darwin/amd64': Object.freeze({ manifestDigest: 'sha256:b4188482621efd7da5a2ab630f653665ab5f80b9aceae448b6bb5fc93e003f06', binaryDigest: 'sha256:ed6232e0bb96a2dcfd86d3c25f86021091600d52f09250403a54528bfe8100a3' }),
    'darwin/arm64': Object.freeze({ manifestDigest: 'sha256:ce7e54fa19f989a5d125c4409b3587ca9503bb5a07bc5ff223c60e0fbad437f0', binaryDigest: 'sha256:3c60f862b04eea1b9a633593b39f1a443d9ca2123cf3edfd150d313e95f3894b' }),
    'windows/amd64': Object.freeze({ manifestDigest: 'sha256:0760fe1fc98e8fedb66796aaf891a1de9268af1338c5e88b949656fda5d9f045', binaryDigest: 'sha256:0f57672d24fc3c70e4cbbf22864e65b35b9978ddaae3793803841536e682929b' }),
  }),
});

function normalizePlatform(platform = process.platform, architecture = process.arch) {
  const osName = platform === 'win32' ? 'windows' : platform;
  if (!['linux', 'darwin', 'windows'].includes(osName)) throw new Error(`Unsupported platform: ${platform}`);
  const arch = architecture === 'x64' ? 'amd64' : architecture;
  if (!['amd64', 'arm64'].includes(arch)) throw new Error(`Unsupported architecture: ${architecture}`);
  if (osName === 'windows' && arch !== 'amd64') throw new Error(`Unsupported architecture for Windows: ${architecture}`);
  return { os: osName, arch, binaryName: osName === 'windows' ? 'nasiko.exe' : 'nasiko' };
}

function getQualifiedRelease(version, platform = process.platform, architecture = process.arch) {
  if (!/^v\d+\.\d+\.\d+$/.test(String(version || ''))) {
    throw new Error('Nasiko installation requires a pinned version such as v0.1.0; latest is not allowed.');
  }
  const normalized = normalizePlatform(platform, architecture);
  const qualification = QUALIFIED_RELEASES[version]?.[`${normalized.os}/${normalized.arch}`];
  if (!qualification) throw new Error(`Nasiko ${version} is not qualified for ${normalized.os}/${normalized.arch}.`);
  return { version, ...normalized, ...qualification, license: LICENSE, sourceUrl: SOURCE_URL };
}

function digestBytes(bytes) {
  return `sha256:${crypto.createHash('sha256').update(bytes).digest('hex')}`;
}

function assertDigest(bytes, expectedDigest, label) {
  if (!SHA256_PATTERN.test(expectedDigest)) throw new Error(`${label} has an invalid expected digest.`);
  const actual = digestBytes(bytes);
  if (actual !== expectedDigest) throw new Error(`${label} digest mismatch: expected ${expectedDigest}, got ${actual}.`);
}

function validateManifest(bytes) {

View on GitHub (pinned to 06c5e118c4)

Solutions

Pin an exact released version that exists in QUALIFIED_RELEASES, currently 'v0.1.0'
If the version comes from a variable, normalize it: `const v = raw.startsWith('v') ? raw : 'v' + raw` and strip prerelease/build suffixes
Reject empty or range-style versions in your config schema before invoking the installer

Example fix

// before
installNasiko({ version: 'latest' });
// after
installNasiko({ version: 'v0.1.0' });

Defensive patterns

Strategy: validation

Validate before calling

const PINNED_VERSION = 'v0.1.0';
if (!/^v\d+\.\d+\.\d+$/.test(PINNED_VERSION)) {
  throw new Error(`Version must be pinned as vX.Y.Z, got: ${PINNED_VERSION}`);
}
await installNasiko({ version: PINNED_VERSION });

Type guard

const isPinnedVersion = (v: unknown): v is `v${number}.${number}.${number}` =>
  typeof v === 'string' && /^v\d+\.\d+\.\d+$/.test(v);

Try / catch

try {
  await installNasiko({ version: requestedVersion });
} catch (error) {
  if (/requires a pinned version/.test(String(error.message))) {
    // Replace 'latest'/semver ranges with the current pinned tag before retrying.
  }
  throw error;
}

Prevention

Treat the Nasiko version as a lockfile entry: one constant, exact format, never a range
Reject 'latest', '^x.y.z', and prerelease strings in config validation upstream
Add a unit test asserting the configured version matches the pinned regex

When it happens

Trigger: Calling getQualifiedRelease (or the installer) with version 'latest', '' or undefined, '0.1.0' (missing the leading v), 'v0.1' or 'v1' (too few segments), or 'v0.1.0-rc.1' (prerelease suffixes fail the strict regex).

Common situations: Copy-pasting 'latest' from other tools' docs into config; scripts that compute version strings without the v prefix; feeds that supply semver ranges like '^1.0.0' or npm-style tags; a CI variable left empty by default.

Related errors

AI-assisted analysis of affaan-m/ECC@06c5e118c4 (2026-08-18). Data as JSON: /api/errors/5e9fa5caa305c585. Report an issue: GitHub.