Before: the catalog retained checksums from the previous packages, so installs would reject the newly published assets. After: both descriptors match the published release repository, tag, commit and asset sizes; anonymous downloads passed the canonical provenance and SHA-256 verifier. Required catalog CI will independently validate the changes before merge.
Only source/index.json changes. Existing Curio ownership and download URLs are preserved.
Merge Danger
Door: two-way
Blast Radius: catalog
Only the rebuilt prerelease entries for Clipboard History and Sub-Store change; the published packages must remain paired with these checksums.
## Summary
Refresh the two 0.0.1-alpha.1 entries to match the rebuilt, published macOS packages.
```diff
- clipboardhistory: b35ffcc6, 947720 bytes
+ clipboardhistory: a08b4067, 2346168 bytes
- substore: b997c0c1, 3572416 bytes
+ substore: 375b9ff9, 3600983 bytes
```
## Evidence
- **Before:** the catalog retained checksums from the previous packages, so installs would reject the newly published assets.
**After:** both descriptors match the published release repository, tag, commit and asset sizes; anonymous downloads passed the canonical provenance and SHA-256 verifier. Required catalog CI will independently validate the changes before merge.
- Only `source/index.json` changes. Existing Curio ownership and download URLs are preserved.
## Merge Danger
**Door:** two-way
**Blast Radius:** catalog
Only the rebuilt prerelease entries for Clipboard History and Sub-Store change; the published packages must remain paired with these checksums.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Refresh the two 0.0.1-alpha.1 entries to match the rebuilt, published macOS packages.
Evidence
After: both descriptors match the published release repository, tag, commit and asset sizes; anonymous downloads passed the canonical provenance and SHA-256 verifier. Required catalog CI will independently validate the changes before merge.
source/index.jsonchanges. Existing Curio ownership and download URLs are preserved.Merge Danger
Door: two-way
Blast Radius: catalog
Only the rebuilt prerelease entries for Clipboard History and Sub-Store change; the published packages must remain paired with these checksums.