install-linux-binary.sh and install-mac.sh were 443 lines that differed
in three places: the OS check and architecture allowlist, the platform
token in the pointer URL and asset name, and clearing the macOS
quarantine attribute. The other ~190 lines were identical.
That duplication already cost something. Hardening the installers meant
applying five fixes twice, by hand, in parallel -- pin-bypass path
traversal, pipeline masking, digest normalisation, directory
destination, and the cross-origin digest check. The next fix would have
had the same shape, and eventually one would land in only one file.
Merge them into install-binary.sh, which detects Linux or macOS and
validates the architecture against what is published for that platform:
Linux ships amd64 and arm64, macOS ships Apple Silicon only.
The release workflow publishes it under the old names as well, so URLs
already in the wild, in the docs, and in the blog post keep working and
pick up the merged behaviour on every release. Nothing needs to change
on the reader's side, and there is no window where a documented command
404s.
Two benign consequences: install-mac.sh now also works on Linux and
install-linux-binary.sh on macOS, and error messages self-identify as
install-binary.sh whichever URL was fetched.
Add install-mac.sh (downloads the Apple Silicon binary, verifies SHA-256,
clears the macOS quarantine attr, prints the move-to-PATH command) and
install-windows.ps1 (downloads the .exe, verifies SHA-256, prints the
move-to-PATH command). Both write to a predictable filename (buckit /
buckit.exe) and use the same atomic temp-then-move + checksum-gate flow as
install-linux.sh.
Publish both to gh-pages in the release workflow, and point install-linux.sh's
non-Linux error at the new scripts.
Set SUDO once (empty when already root, "sudo " when sudo is available,
empty with a warning otherwise) and build INSTALL_CMD from it, so the printed
install command is correct on root/container hosts without sudo.
Write the download to a temporary sibling file and only mv it into the
predictable buckit.<ext> path after the checksum verifies, with an EXIT trap
to clean up on failure. A failed or interrupted download can no longer leave
a partial/unverified file or overwrite an existing good package.
Revert the --install non-interactive mode. The script again only downloads,
verifies, and prints the install command. Instead of a versioned name in a
temp dir, the package is saved to a predictable buckit.rpm / buckit.deb /
buckit.apk in the current directory (overridable via BUCKIT_DOWNLOAD_DIR), so
the printed install command is stable and copy-pasteable in docs.
Default behavior is unchanged (download, verify, print the install command).
Passing --install runs the detected install command automatically after a
successful checksum verification, for docs and automation use.
Execution reuses the detected command via unquoted word-splitting of the
fixed INSTALL_CMD words with the package path as a single quoted argument —
reliable in POSIX sh without eval.
abuckit