Presenter's voice engine now installs from GitHub, built and signed in the open

1 hour ago

Presenter 1.9.3 changes where the action gets its voice engine. It installs bisque-voice 0.1.38 now, and it downloads it from GitHub. That release is built, signed and attested in the open, and your workflows need no edits to pick it up.

Ask about this presentation

Chapters

  1. 0:00Voice engine from GitHub
  2. 0:18Engine 0.1.38
  3. 0:34Built in the open
  4. 0:52New download URL
  5. 1:06Pinned checksums
  6. 1:24What could break
  7. 1:42Upgrade
Show transcript
  1. Presenter 1.9.3 changes where the action gets its voice engine. It installs bisque-voice 0.1.38 now, and it downloads it from GitHub. That release is built, signed and attested in the open, and your workflows need no edits to pick it up.

    Slide text
    Presenter v1.9.3

    The voice engine now installs from GitHub


    bisque-voice 0.1.35 → 0.1.38   ·   bisque-cloud/presenter
    Signed · Attested
  2. The version constant in install-bisque-voice.ts moves from 0.1.35 to 0.1.38. That one constant decides which engine the action installs, so every run after the upgrade uses the new build.

    Slide text
    The engine
    VERSION in install-bisque-voice.ts
    0.1.35
    0.1.38
    One constant picks the engine the action installs.
  3. Why does this matter to you? The engine runs on your build machines. The maintainers call 0.1.38 the first release built, signed and attested in the open, in the public bisque-voice repository. The binary you run now comes from a build you can inspect.

    Slide text
    Why it matters

    The first engine built in the open

    “the first release built, signed and attested in the open in bisque-cloud/bisque-voice”
    Release notes, v1.9.3
  4. In the same file, the download URL changes. The tarball used to come from download dot bisque dot today. Now it comes from the GitHub Releases page of the bisque-voice repository, for the same version and the same platform name.

    Slide text
    The change in the code

    Downloads move to GitHub Releases

    Before
    https://download.bisque.today/bisque-voice/v${VERSION}/bisque-voice-${triple}.tar.gz
    After
    https://github.com/bisque-cloud/bisque-voice/releases/download/v${VERSION}/bisque-voice-${triple}.tar.gz
  5. The installer pins a SHA-256 checksum for each platform's tarball. The release notes say every one of them is updated to match 0.1.38, on Mac, Linux and Windows. Nothing for you to copy, because the values ship inside the action.

    Slide text
    Integrity

    Every platform checksum updated

    SHA-256 in CHECKSUMS
    aarch64-apple-darwin 7660f7d7…ef50
    x86_64-apple-darwin decc4fc6…dfad
    x86_64-unknown-linux-gnu ae2b5397…de8a
    aarch64-unknown-linux-gnu 75f367ef…840d
    x86_64-pc-windows-msvc bbfec12b…8515
  6. The one thing that can break is the network path. The engine used to come from download dot bisque dot today. It now comes from github dot com. If your runners sit behind an allow list for outbound traffic, add GitHub before you upgrade, or the engine download will be blocked.

    Slide text
    What could break

    One host changed

    Before
    download.bisque.today
    Allow this host
    github.com
    for the bisque-voice tarball
  7. Upgrading is a version bump. The change is confined to the installer, so there is nothing to migrate. Point your workflow at presenter v1.9.3 and the new engine installs on the next run. The one reason to hold off is a runner that cannot reach GitHub yet. Otherwise, the voice engine now comes from a build made in the open.

    Slide text
    What to do

    Upgrade to v1.9.3, no config changes

    Go
    Point your workflow at presenter@v1.9.3
    Wait
    if your runners can’t reach github.com yet

What happened in AI today, in your inbox

One short email each evening. Read it and you’re caught up.

Built with ❤️ in New York