install/launch scripts: make install target + curl-pipeable install.sh #3

Merged

xenarathon merged 8 commits from worktree-install-launch-scripts into main

2026-08-01 17:05:15 -04:00

xenarathon commented

2026-08-01 15:57:02 -04:00

Owner

Adds two installation paths, closing out the last backlog item.

make install — developer path, builds and installs to $(go env GOPATH)/bin, no sudo.
install.sh — end-user path (curl -fsSL .../install.sh | sh): detects platform, downloads + verifies the release tarball (checksum, never a silent pass on a missing SHA256SUMS entry), picks an install location (~/.local/bin if writable and on PATH, else /usr/local/bin via sudo), installs the binary, and on Linux registers a .desktop menu entry. POSIX sh/dash-compatible, no bashisms.

Spec + plan went through two rounds of external review (salyut multi-model consult + a manual review) before implementation, and each of the 6 implementation tasks was independently reviewed and approved. A final whole-branch review caught one Critical finding — --proto-redir=https was a silent no-op (bare protocol name defaults to curl's additive + modifier, so it restricted nothing) — fixed to --proto-redir==https and independently verified against a live redirect. Also fixed in the same pass: install.sh wasn't wired into the release artifacts the README told users to curl, install_test.sh wasn't wired into CI, and a checksum-mismatch failure discarded its own diagnostic output.

Test plan

go test -race ./... — 272/272 passing
sh install_test.sh — 44/44 passing
CI run on this PR (adds a new install.sh tests (dash) step)

🤖 Generated with subagent-driven development

Adds two installation paths, closing out the last backlog item. - `make install` — developer path, builds and installs to `$(go env GOPATH)/bin`, no sudo. - `install.sh` — end-user path (`curl -fsSL .../install.sh | sh`): detects platform, downloads + verifies the release tarball (checksum, never a silent pass on a missing SHA256SUMS entry), picks an install location (`~/.local/bin` if writable and on PATH, else `/usr/local/bin` via sudo), installs the binary, and on Linux registers a `.desktop` menu entry. POSIX `sh`/dash-compatible, no bashisms. Spec + plan went through two rounds of external review (salyut multi-model consult + a manual review) before implementation, and each of the 6 implementation tasks was independently reviewed and approved. A final whole-branch review caught one Critical finding — `--proto-redir=https` was a silent no-op (bare protocol name defaults to curl's additive `+` modifier, so it restricted nothing) — fixed to `--proto-redir==https` and independently verified against a live redirect. Also fixed in the same pass: `install.sh` wasn't wired into the release artifacts the README told users to curl, `install_test.sh` wasn't wired into CI, and a checksum-mismatch failure discarded its own diagnostic output. ## Test plan - [x] `go test -race ./...` — 272/272 passing - [x] `sh install_test.sh` — 44/44 passing - [ ] CI run on this PR (adds a new `install.sh tests (dash)` step) 🤖 Generated with subagent-driven development

xenarathon added 8 commits

2026-08-01 15:57:02 -04:00

redakt: add make install target 9e1990b942

redakt: install.sh platform detection + test harness skeleton 69a5fb7993

redakt: install.sh download + checksum verification a97d6d5c5f

Implement download+verify stage functions:
- detect_checksum_tool(): detect sha256sum/shasum, set CHECKSUM_CMD
- version_ge(): POSIX major.minor.patch comparator
- detect_curl_proto_redir_support(): gate curl version >= 7.85.0
- download_and_verify(): fetch tarball+SHA256SUMS, verify integrity

Add comprehensive test suite: 9 new test functions covering success,
failure modes (mismatch, missing entry), and version comparisons. All 22
tests pass (7 existing + 15 new).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

redakt: install.sh install-location selection + binary install 45c40c4ba0

Implements choose_install_dir() to select ~/.local/bin if on PATH and
writable, else fall back to /usr/local/bin with sudo. Uses colon-delimited
PATH boundary matching to avoid substring false-positives. Implements
install_binary() to extract tarball, print overwrite notice if needed, and
install via plain or sudo-prefixed install command. Includes 6 new tests
covering both functions across all code paths.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

redakt: add install_binary sudo + extraction-failure test coverage 4617df16d7

Fills two coverage gaps found in task review:
- test_install_binary_with_sudo_path: exercises sudo branch of install_binary()
- test_install_binary_extraction_failure: exercises tar extraction failure path

Both tests stub required PATH commands and assert correct behavior/error handling.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

redakt: install.sh desktop entry + final message + main wiring b0a4680456

Adds write_desktop_entry (Linux-only, best-effort, never fails the
overall install) and print_final_message, then replaces the
Task-2-era placeholder main() with the fully-wired pipeline:
detect_platform -> detect_checksum_tool -> detect_curl_proto_redir_support
-> download_and_verify -> choose_install_dir -> install_binary ->
write_desktop_entry -> print_final_message.

redakt: document install.sh + make install in README e70645fc1f

redakt: fix curl proto-redir no-op, wire release asset + CI, surface checksum diagnostic

CI / build / test / lint (pull_request) Failing after 6m6s

Details

b47c9c39db