Gah – CLI to install software from GitHub Releases | Hacker News Reader

Gah – CLI to install software from GitHub Releases

github.com

35 pointsmarverix29 comments

Open articleView on HN

This seems to be similar to eget: https://github.com/zyedidia/eget

eget was developed by the same person like the micro terminal text editor.

Software installers should check hashes and signatures before installing anything.

Doesn't GitHub support package repositories for signed packages?

https://slsa.dev/get-started explains about verifiable build provenance attestations:

> SLSA 2

> To achieve SLSA 2, the goals are to:

> - Run your build on a hosted platform that generates and signs provenance

> - Publish the provenance to allow downstream users to verify

> [...]

> SLSA 3

> To achieve SLSA 3, you must:

> - Run your build on a hosted platform that generates and signs provenance

> - Ensure that build runs cannot influence each other

> - Produce signed provenance that can be verified as authentic

And:

> For now, the convention is to keep the provenance attestation with your artifact. Though Sigstore is becoming more and more popular, the format of the provenance is currently tool-specific.

That's what' Aqua [0] does plus more!

[0]: https://aquaproj.github.io/

From https://aquaproj.github.io/ :

> aqua installs tools securely. aqua supports Checksum Verification, Policy as Code, Cosign and SLSA Provenance, GitHub Artifact Attestations, and Minisign. Please see Security.

Seems very similar to https://dist.sh/ but distillery seems a bit more robust.

ubi https://github.com/houseabsolute/ubi is the one I know, as it is available in mise https://mise.jdx.dev/dev-tools/backends/ubi.html

Nice! Shame that I didn't knew about it earlier

nice work marverix, love seeing bash used like this.

Thanks! <3

dist author here. since darren0 was so kind to reference my tool, I'll just add dist is written in go, is cross platform, can handle github, gitlab, homebrew packages (with caveats), and a few others and you can create custom aliases as well. there are a few additional features in the works right now. also supports signature and checksum verification if available.

There's also https://github.com/zyedidia/eget, which is also written in Go.

Here is my HN submission about eget: https://news.ycombinator.com/item?id=41479539

It's great to see movement in this space. The main problem in my experience is github api and throttling. It's really hard to download 40 binaries while building an image for CI/CD. Binaries themselves are CDNed, but github apis to find them are easily throttled, especially behind NAT.

Need to have some caching mechanism avoid this. Eget seems currently abandoned, maybe gah can start looking stuff in a cache.

the dist project referenced above supports both caching and authentication for both github and gitlab.

yes, i added it to my blog post, will investigate

cool. please let me know when you post, I would like to read. I'm the author of dist if that wasn't clear. Also looking for feedback on the project should you find it useful.

DuckDB binary downloaders compared

`eget` wins:

    eget duckdb/duckdb
    2 candidates found (unsure architecture): please select manually
    (1) duckdb_cli-osx-universal.zip
    (2) libduckdb-osx-universal.zip
    Enter selection number:

Afterwards it correctly unzips. Can use cmdline flag to match artifacts

`gah` fails:

    gah install duckdb/duckdb
    Fetching release info for: duckdb/duckdb [latest]
    Found release: v1.1.3 Bugfix Release
    Downloading:
    Warning: output file name has no length
    curl: option -o: is badly used here

(Using curl 8.4.0 on macOS)

`dist` also fails:

    dist install duckdb/duckdb
    • determining latest version 
    • version: 1.1.3
    ⨯ no matching asset found, score too low
    ⨯ closest matching: duckdb_cli-osx-universal.zip (34) (threshold: 40)

Thanks for testing. I'm guessing you trimmed the output a bit there, it would normally say you can override using --no-score-check.

I've fixed this and cut a new release, dist 1.0.5.

--no-score-check didn't help, so i didn't include it.

Works with your fix.

I sent you an email to schedule a chat. Hope you don't mind. I'm very thankful for your work in this space. Will keep testing this in place of my eget workflows.

Some thoughts so far:

1. ability to pick my own dir or to default to .local/bin . Eg I love using eget from ansible to drop various useful binaries

2. Ability to override github url, so I could do my own token management/cache in a centralized way. This would fix the biggest downside of such tools in CI.

3. It would be nice if there was an option to build go apps. Eg terraform(which you have a workaround for), and obscure stuff like https://github.com/Mic92/ssh-to-age/tree/main . I love that go makes this easy https://bsky.app/profile/taras.glek.net/post/3lcau3yaftc2n

4. lazy mode. I have an ad-hoc script to lazily download various nice-to-have-but-heavy binaries into devcontainer on my team. Eg it's a bash script that checks if usql is in path, if it's not, it downloads a pinned version and runs it and passes args through. Given how fast most binaries are this is the only way to have all the binaries we need without wasting gigs of space of stuff that only 1 person on team may use.

Interesting, I'll look into the no-score-check.

Technically there's a config file and you can set the path, it's not been tested a lot on custom paths and I haven't documented it yet, but if you look at the source it'll show you how.

I'm working on a Distfile so be able to install multiple pinned versions at the same time, I'm also working on installing multiple binaries at the same time.

I think compiling go is something I'll stay away from. I think it would be better to encourage folks like mic92 to use goreleaser and publish static binaries.

I thought that no one in right mind will use underscore in the binary name, but it seems that I had too much faith in humanity. Fixed:

     gah install duckdb/duckdb
    Fetching release info for: duckdb/duckdb [latest]
    Found release: v1.1.3 Bugfix Release
    Several download URLs were found which match your OS and arch. Please select one:
    1) https://github.com/duckdb/duckdb/releases/download/v1.1.3/duckdb_cli-linux-    amd64.zip
    2) https://github.com/duckdb/duckdb/releases/download/v1.1.3/libduckdb-linux-amd64.zip
    #? 1
    Downloading: duckdb_cli-linux-amd64.zip
    ##################### 100,0%
    Extracting: duckdb_cli-linux-amd64.zip
    Installing: duckdb
    Give a new name or keep 'duckdb'? (Leave empty to keep the same)
    New name: 
    Installed: duckdb
    Done!

`gogo` get it right :)

This is so funny and also a commentary on my inability to perform searches in github I guess.

A month ago I was looking for something like this, so I created https://github.com/fusion/gogo

Now this thread is revealing an abundance of alternate tools.

I'm considering creating a "list of fetching tools" just to help folks find the one they want, since some features described here are very interesting.

> gah is an GitHub Releases app installer, that does not require sudo

?. I am sure it does if installed to /usr or /usr/local.

If installed to ~/.local, then obviously no root required. How is this a feature?

Do alternatives not allow installing to custom destination path?

Nice! Shameless plug, I've made a similar tool recently, which uses a manifest file instead: https://github.com/ClementNerma/Fetchy

Fetchy is really nice! I really like the how smooth it looks in demo. Only thing that I don't like is the manifest file. Personally, I would be too lazy to create one. But I find use case for it for organizations, when you want to keep it as a code in repo, which pre-defined versions for whole organization. If, for example, you would be able to tell fetchy to use remote manifest that would be a game changer for organizations.

Yes, Fetchy is only the base block, and I don't expect anyone to actually build their own repository.

You can actually use the example one which contains a few common tools.

I've been using Aqua [0] and I'm super happy with it!

[0]: https://aquaproj.github.io/

Should probably include "Show HN" in the title

Sorry, I will do it next time. Thank you for the comment.

Reply on news.ycombinator.com