From 73e1224345cffd6b41c75717a6273a862d44116c Mon Sep 17 00:00:00 2001
From: enricobuehler <buehler@unom.io>
Date: Thu, 30 Jul 2026 15:23:43 +0200
Subject: [PATCH] =?UTF-8?q?fix(ci/update):=20an=20empty=20AUTHENTICODE=5FS?=
 =?UTF-8?q?HA256=20broke=20the=20manifest=20build=20=E2=80=94=20jq=20-R=20?=
 =?UTF-8?q?needs=20one=20input=20line?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

printf '%s' hands jq -R no line at all for an empty value; its empty output made
--argjson invalid. Seen on the first live canary-manifest run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit a12c8bc99d41c4f7b8e4c426d560171b2b12dd5e)
---
 scripts/ci/publish-update-manifest.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/ci/publish-update-manifest.sh b/scripts/ci/publish-update-manifest.sh
index 7182dfae..7c644d6f 100644
--- a/scripts/ci/publish-update-manifest.sh
+++ b/scripts/ci/publish-update-manifest.sh
@@ -83,7 +83,11 @@ SERIAL="$(date +%s)"
 PUBLISHED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 MANIFEST="$WORK/manifest.json"
 
-AUTH_JSON="$(printf '%s' "${AUTHENTICODE_SHA256:-}" | jq -R 'split(",") | map(select(length > 0))')"
+# `printf '%s\n'`, not '%s': an EMPTY value must still hand jq one (empty) input line —
+# with no line at all, `jq -R` emits nothing and `--argjson auth ""` is invalid JSON
+# (bit the first live canary publish). The fallback belts the suspenders.
+AUTH_JSON="$(printf '%s\n' "${AUTHENTICODE_SHA256:-}" | jq -R 'split(",") | map(select(length > 0))')"
+AUTH_JSON="${AUTH_JSON:-[]}"
 jq -n \
   --arg channel "$CHANNEL" \
   --arg version "$VERSION" \