ci(q-verify): drop the invented KX_INSTALL_TOKEN; no bearer token is needed - #11
Merged
Conversation
…telemetry off
The token requirement in the first revision was INFERRED from licensing-notes'
phrase "authenticated curl script with an OAuth bearer token" and never measured.
It is wrong, and the 401 I cited as confirming it came from my own mistyped URL,
which was missing the `/install_kdb/~latest~/` path segment. A guess that produces
a plausible error code is the most expensive kind.
Measured 2026-07-29, unauthenticated:
.../install_kdb/~latest~/install_kdb.sh 200, byte-identical to the known-good
local copy (63703 bytes, v1.11.0)
.../kdb-x/~latest~/{l64,m64,l64arm}.zip 200
and the installer's own download_file() uses a bare `curl --fail -Lo` with no auth
header — the same conclusion reached from the other direction. The Developer
Center pre-populates `--oauth2-bearer <token>` in the command it hands you, which
is what made it look gated.
So q-verify now needs ONE secret, KX_B64LIC, which is already set. Nothing here
circumvents a licence check: kc.lic is still required for q to RUN and is still
the secret; only the download endpoint is open.
Also found while reading the installer, and worth more than the token fix:
setup_telemetry() runs q against the licence and tests `.z.l[4]` for "tld"; if that
matches it sets KX_UPLOAD_TELEMETRY=YES *before* reaching the non-interactive
branch that would default it to NO. docs/licensing-notes.md records the decision to
decline telemetry, and the author's local config has it NO — but on CI that would
have been left to whatever a licence flag says. Now forced to NO after install and
asserted, so the decision is deterministic rather than incidental.
Install invocation is `-y --b64lic`, which the script requires together; INSTALL_DIR
defaults to $HOME/.kx, so q lands at $HOME/.kx/bin/q.
Still not observed green end to end — the install has never completed on a runner.
Next step is a manual dispatch.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You do not need a
KX_INSTALL_TOKEN. I inferred that requirement fromlicensing-notes.md'sphrase "authenticated curl script with an OAuth bearer token" and never measured it. It's wrong —
and the 401 I cited as confirming it came from my own mistyped URL, missing the
/install_kdb/~latest~/path segment. A guess that produces a plausible error code is the mostexpensive kind.
Measured, unauthenticated
…/install_kdb/~latest~/install_kdb.sh…/kdb-x/~latest~/{l64,m64,l64arm}.zipAnd the installer's own
download_file()uses a barecurl --fail -Lowith no auth header — thesame conclusion from the other direction. The Developer Center pre-populates
--oauth2-bearer <token>into the command it hands you, which is what made the download look gated.So
q-verifyneeds one secret,KX_B64LIC— already set. Nothing here circumvents a licencecheck:
kc.licis still required for q to run and is still the secret; only the downloadendpoint is open.
The better find: telemetry would have been left to chance
Reading the installer,
setup_telemetry()runs q against the licence and tests.z.l[4]for"tld". If that matches it setsKX_UPLOAD_TELEMETRY=YESbefore reaching the non-interactivebranch that would otherwise default it to
NO.docs/licensing-notes.mdrecords the decision to decline telemetry, and your local config has itNO— but on CI that would have been decided by whatever a licence flag happens to say. Now forcedto
NOafter install and asserted, so the decision is deterministic rather than incidental.Still not proven
The install has never completed on a runner. Next step is a manual dispatch after merge — that's
the real test, and I'll report what it actually does rather than assume.
🤖 Generated with Claude Code