Skip to content

updates.md

Latest commit

 

History

History
68 lines (51 loc) · 2.58 KB

updates.md

File metadata and controls

68 lines (51 loc) · 2.58 KB
Raw

Updates and installation

fetch ships as statically built Go binaries for Linux, macOS, and Windows on amd64 and arm64. Unix release archives have lowercase SHA-256 sidecars.

Install

For macOS and Linux, the installer downloads the matching Go archive, verifies its sidecar before extraction, validates fetch --version, and atomically renames a staged executable:

curl -fsSL https://raw.githubusercontent.com/ryanfowler/fetch/main/install.sh | bash

Set FETCH_INSTALL_DIR to choose an installation directory. The installer rejects target symlinks and directories, archives with unexpected entries, and partial or invalid binaries. It uses /usr/local/bin when writable and then ~/.local/bin. Windows users can use a release archive or fetch --update.

To build from source:

go install github.com/ryanfowler/fetch@latest

Manual update

fetch --check-update
fetch --update
fetch --update --dry-run

--check-update reports the latest release. --update downloads the matching archive and requires a SHA-256 sidecar. Metadata is limited to 1 MiB, checksum sidecars to 1 KiB, and archives to 128 MiB. Archive contents are bounded to 128 entries and 512 MiB unpacked data. The archive is not opened until checksum verification succeeds.

Update requests inherit only operational proxy, DNS, CA, connect-timeout, and request-timeout settings. They do not inherit origin headers, cookies, sessions, credentials, --insecure, client certificates, Unix sockets, or forced HTTP versions. Redirects remain HTTPS-only and are limited to 10.

Dry-run downloads bounded release metadata and the checksum sidecar to validate asset selection and checksum availability. It does not download the executable archive, replace the binary, or update the automatic-check timestamp.

The update destination must not be writable by its group or by other users. If --update reports that the replacement directory is writable, remove those permissions with chmod go-w <directory> (use sudo if needed), or install fetch in a private directory such as ~/.local/bin.

Automatic checks

Set an interval in the configuration file:

auto-update = 12h

true means 24 hours and false disables checks. A normal validated request may start one detached, silent updater child when the interval is due. Help, version, build information, completion, skill management, dry-run, and updater children do not start automatic checks. Automatic failures do not change the requested fetch result. Metadata is advisory and stored in the platform user cache with bounded, atomic, symlink-safe writes.