From fdb39a78a5aaab029e98ad56c7060616df03be98 Mon Sep 17 00:00:00 2001 From: dc Date: Thu, 24 Sep 2026 22:30:38 +0000 Subject: [PATCH 1/2] docs(downloads): new page for release assets and download verification Adds /downloads to the Installation section, listing what each release asset is for and how to verify a download against the SHA256SUMS file the release pipeline publishes (sha256sum -c, plus certutil for Windows). The SAS 9 deployment page now links to it wherever it sends the reader to the releases page. mkdocs build passes; nav, sitemap and cross-links verified in the rendered output. --- docs/dci-deploysas9.md | 8 ++++--- docs/downloads.md | 52 ++++++++++++++++++++++++++++++++++++++++++ mkdocs.yml | 1 + 3 files changed, 58 insertions(+), 3 deletions(-) create mode 100644 docs/downloads.md diff --git a/docs/dci-deploysas9.md b/docs/dci-deploysas9.md index d550797..06bab80 100644 --- a/docs/dci-deploysas9.md +++ b/docs/dci-deploysas9.md @@ -14,6 +14,8 @@ There are two ways to deploy Data Controller on SAS 9: * Full Deployment (preferred) * Streaming (for quick demos) +Both fetch a deployment program from the [releases page](https://git.datacontroller.io/dc/dc/releases) - see the [downloads page](/downloads) for what each asset contains and how to verify it. + ### Full Deployment #### 1 - Deploy Stored Processes @@ -27,7 +29,7 @@ filename dc url "https://git.datacontroller.io/dc/dc/releases/download/latest/sa %inc dc; ``` -If you don't have internet access from SAS, download `sas9.sas` from [here](https://git.datacontroller.io/dc/dc/releases), and change the initial `compiled_apploc` and `compiled_serverName` macro variable assignments as necessary. +If you don't have internet access from SAS, download `sas9.sas` from [here](https://git.datacontroller.io/dc/dc/releases), verify it against the release `SHA256SUMS` file ([downloads page](/downloads/#verifying-a-download)), and change the initial `compiled_apploc` and `compiled_serverName` macro variable assignments as necessary. #### 2 - Deploy the Frontend @@ -35,7 +37,7 @@ The Data Controller frontend comes pre-built, and ready to deploy to the SAS Web Deploy as follows: -1. Download the `frontend.zip` file from: [https://git.datacontroller.io/dc/dc/releases](https://git.datacontroller.io/dc/dc/releases) +1. Download the `frontend.zip` file from: [https://git.datacontroller.io/dc/dc/releases](https://git.datacontroller.io/dc/dc/releases) (verify it against the release `SHA256SUMS` file - see the [downloads page](/downloads/#verifying-a-download)) 2. Create a folder for Data Controller in the [htdocs folder of your SAS Web Server](https://sasjs.io/frontend-deployment/#sas9-deploy) - typically a subdirectory of: `!SASCONFIG/LevX/Web/WebServer/htdocs` - and unzip the archive **into** that folder. The archive holds the frontend files at its root, so `index.html` sits directly inside your folder (alongside the `images` folder and the compiled asset files) - for example `htdocs/dc/index.html`. 3. Open the `index.html` file and update the values in the `` tag as follows: @@ -93,7 +95,7 @@ filename dc url "https://git.datacontroller.io/dc/dc/releases/download/vX.X.X/de %inc dc; ``` -If you don't have internet access from your SAS environment, just download `demostream_sas9.sas` from [https://git.datacontroller.io/dc/dc/releases](https://git.datacontroller.io/dc/dc/releases) and modify the `appLoc` on line 2, as follows: +If you don't have internet access from SAS, download `demostream_sas9.sas` from [https://git.datacontroller.io/dc/dc/releases](https://git.datacontroller.io/dc/dc/releases) (verify it against the release `SHA256SUMS` file - see the [downloads page](/downloads/#verifying-a-download)) and modify the `appLoc` on line 2, as follows: ![](img/sas9_apploc.png) diff --git a/docs/downloads.md b/docs/downloads.md new file mode 100644 index 0000000..0272701 --- /dev/null +++ b/docs/downloads.md @@ -0,0 +1,52 @@ +--- +layout: article +title: DC Downloads +description: Data Controller release assets and how to verify them +--- + +# Downloads + +Data Controller releases are published on the [releases page](https://git.datacontroller.io/dc/dc/releases) of the source repository. Every release carries the same set of assets: + +| Asset | Use | +|---|---| +| `frontend.zip` | The pre-built web frontend, for deployments that serve the frontend from a web server (SAS 9 full deploy, Viya separated deploy) | +| `sas9.sas` | SAS 9 full deployment program (stored processes + frontend registration) | +| `demostream_sas9.sas` | SAS 9 streaming deployment program (demos and evaluations) | +| `viya.sas` | Viya streaming deployment program (backend + frontend) | +| `viya_noweb.sas` | Viya separated deployment program (backend only) | +| `viya_noweb.json` | The Viya backend services as a SASjs Drive JSON deployment bundle | +| `sasjs_server.json.zip` | SASjs Server deployment bundle (all services, for [SASjs Server](https://server.sasjs.io) deployments) | +| `SHA256SUMS` | SHA-256 checksums for every asset above | + +Which asset you need depends on the deployment route - see [SAS 9 Deployment](/dci-deploysas9) or [SAS Viya Deployment](/deploy-viya). + +## Verifying a download + +Every asset is covered by the `SHA256SUMS` file, which the release pipeline generates over the exact files it uploads. To verify a download: + +1. Download the asset (for example `frontend.zip`) from the [releases page](https://git.datacontroller.io/dc/dc/releases). +2. Download `SHA256SUMS` from the same release into the same folder. +3. Run the check: + +```bash +sha256sum --check SHA256SUMS --ignore-missing +``` + +Each asset that matches reports `OK`. The `--ignore-missing` flag means you only need the files you actually downloaded - the check skips assets you did not fetch. + +On Windows, `certutil` can compute the hash of a single file for comparison against the value listed in `SHA256SUMS`: + +``` +certutil -hashfile frontend.zip SHA256 +``` + +### What the checksum proves + +A matching checksum confirms the asset is byte-for-byte the file the release pipeline uploaded. It catches corrupted and tampered downloads - interrupted transfers, proxies or mirrors that altered the file in transit. + +It is not a cryptographic signature. The hashes travel in the same release as the files they cover, so they protect the download path, not the release itself: a compromise of the forge would allow both the asset and its checksum to be altered together. For download integrity - the typical concern when fetching deployment artifacts over the internet - it is the standard check. + +## Integrity inside SAS + +The SAS deployment programs embed the frontend and services as generated SAS code. Once `%inc`'d, their integrity is established by the check above at download time; SAS also writes nothing to disk outside the `appLoc` you point it at, and the programs can be [reviewed in full](https://code.datacontroller.io) (or in the [source repository](https://git.datacontroller.io/dc/dc)) before you run them. diff --git a/mkdocs.yml b/mkdocs.yml index 7371cbb..c531a0b 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -71,6 +71,7 @@ nav: - Macros: macros.md - Installation: - System Requirements: dci-requirements.md + - Downloads: downloads.md - SAS Viya: deploy-viya.md - SAS 9 EBI: dci-deploysas9.md - SAS 9 STP Hardening: dci-stpinstance.md -- 2.43.0 From 4316f519c47b26e9a49754896b4086a9a04c0ab6 Mon Sep 17 00:00:00 2001 From: dc Date: Fri, 25 Sep 2026 19:33:42 +0000 Subject: [PATCH 2/2] docs(downloads): appLoc is a metadata folder, not a disk location The integrity section claimed SAS writes nothing to disk outside the appLoc. The appLoc is the SAS Folder the stored processes or jobs are deployed into (metadata), so it is not a disk location at all - the only physical location the deployment programs write to is the Data Controller location (dcLoc) configured at first launch. --- docs/downloads.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/downloads.md b/docs/downloads.md index 0272701..2686d04 100644 --- a/docs/downloads.md +++ b/docs/downloads.md @@ -49,4 +49,4 @@ It is not a cryptographic signature. The hashes travel in the same release as th ## Integrity inside SAS -The SAS deployment programs embed the frontend and services as generated SAS code. Once `%inc`'d, their integrity is established by the check above at download time; SAS also writes nothing to disk outside the `appLoc` you point it at, and the programs can be [reviewed in full](https://code.datacontroller.io) (or in the [source repository](https://git.datacontroller.io/dc/dc)) before you run them. +The SAS deployment programs embed the frontend and services as generated SAS code. Once `%inc`'d, their integrity is established by the check above at download time. They deploy the stored processes or jobs into the SAS Folder you nominate (`appLoc`) - a metadata location, not physical disk - and the only physical location they write to is the Data Controller location (`dcLoc`) you configure. The programs can be [reviewed in full](https://code.datacontroller.io) (or in the [source repository](https://git.datacontroller.io/dc/dc)) before you run them. -- 2.43.0