mirror of
https://github.com/buckit-io/buckit.git
synced 2026-09-19 09:05:49 +00:00
abuckit
fa2f0483a4
install-linux.sh downloads a native package and registers a systemd service, which is the wrong shape for deployments that run the server binary directly -- a hand-run process, a non-systemd supervisor, or a MinIO deployment being migrated in place. Add a Linux counterpart to install-mac.sh that fetches only the binary: resolve the current release from the gh-pages pointer, download the matching asset, verify its SHA-256, chmod it, and leave ./buckit in the working directory. It does not touch PATH and does not install a service. The checksum is verified against both the release-host .sha256sum and the digest published in the gh-pages pointer, and the two must agree. The binary and its adjacent checksum share an origin, so that digest alone only proves the transfer was not corrupted; the pointer is served from a different origin and turns the check into something an attacker must defeat in two places. A pinned BUCKIT_VERSION skips the cross-check, since the pointer only ever describes the latest release. Publish the script to gh-pages alongside the others, and advertise it in the README and the generated release-notes install table.
