feat: add an install script for macOS and Linux - #27
Merged
Conversation
install.sh downloads the release archive matching the detected OS and architecture, verifies it against the release's checksums.txt, and installs the binary into ~/.local/bin without root privileges or a package manager. When cosign is present the keyless bundle over checksums.txt is verified too, and a failure aborts; nothing is written before verification passes. The Pages workflow copies the root script into the site artifact so https://jwtd.sh/install.sh serves the reviewed file byte-for-byte. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
install.sh, a package-manager-free installer for macOS and Linux:curl -fsSL https://jwtd.sh/install.sh | shWhat it does
uname -s/uname -monto the GoReleaser archive names (jwtd-<os>-<arch>.tar.gz), with a Rosetta correction so a translated shell on Apple silicon does not get the Intel binary. Unsupported platforms — including Windows kernels — fail before any download and point at WinGet/Scoop.checksums.txtfrom the latest release, or from--version v5.3.0.~/.local/bin(--dir/JWTD_INSTALL_DIRto override) and warns, with bash/zsh and fish hints, when that directory is not onPATH.Verification
The archive is always checked against its
checksums.txtentry (sha256sum, falling back toshasum -a 256). Whencosignis onPATH, the keyless bundle overchecksums.txtis verified against the release workflow's certificate identity, and a cosign failure aborts. cosign stays optional because most machines do not have it and the checksum already pins the bytes — but a present cosign is never advisory. Nothing is written to the install directory before verification passes.The script runs under POSIX
sh(it is piped into whatever/bin/shthe user has) and never callssudo, so piping it into a shell is not a privilege decision. The binary is copied into the install directory under a temporary name and renamed within it, making the replacement a same-filesystemrename(2): an upgrade cannot leave a half-written binary behind and does not fail withETXTBSYwhen the running shell's ownjwtdis replaced.Delivery
pages.ymlcopies the repository-root script into the Pages artifact (install -m 0755 install.sh site/install.sh, git-ignored), sohttps://jwtd.sh/install.shserves the reviewed file byte-for-byte, and redeploys wheninstall.shchanges. There is one copy of the script.Documented in the README installation section and in the macOS and Linux install panels on the site; the release-security section notes the installer runs the same verification.
RELEASE_NOTES.mdcarries prose for the next release.Testing
install_test.gopins the archive naming to.goreleaser.yaml, the verify-before-install ordering, the Cosign identity matching the README, thesh/no-sudoproperties, and the README/site/Pages wiring. Its behavior tests are hermetic: platform rejection is driven by a stubbeduname, so no test touches the network.Manually verified against the real release: fresh install, pinned
--version 5.2.0over an existing binary, relative--dir, and — via a stubbedcurlserving doctored assets — that a checksum mismatch, a missing checksum entry, and a bogus Cosign bundle each abort with nothing written to the install directory.gofmt,go vet,go test ./..., the site JS tests, andshellcheck -s share clean.🤖 Generated with Claude Code