serve.zone/nupst
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

3 Releases 115 Tags

RSS Feed
  • v6.1.0 ae6b70e808
    Compare

    NUPST v6.1.0
    Release / build-and-release (push) Successful in 1m31s
    Details
    Stable

    jkunz released this 2026-09-15 22:28:05 +00:00 | 0 commits to main since this release

    NUPST v6.1.0

    Pre-compiled binaries for multiple platforms.

    Installation

    Use the installation script:

    curl -sSL https://code.foss.global/serve.zone/nupst/releases/download/latest/install.sh | sudo bash

    Install this exact version by appending -s -- --version v6.1.0, or download the binary
    for your platform from the assets below and make it executable.

    Upgrading from NUPST v6.0.0 or earlier: those versions fetch the install script from
    raw/branch/main, which is no longer readable without a Gitea account, so their
    nupst update fails. Re-run the installation one-liner above once; every later update
    works normally.

    Supported Platforms

    • Linux x86_64 (x64)
    • Linux ARM64 (aarch64)
    • macOS x86_64 (Intel)
    • macOS ARM64 (Apple Silicon)
    • Windows x86_64

    Checksums

    SHA256 checksums for every asset of this release, including install.sh, uninstall.sh and
    changelog.md, are provided in SHA256SUMS.txt

    Changes

    Features

    • ship the whole install flow as release assets (install)
      • Publishes install.sh, uninstall.sh and changelog.md as Gitea release assets and lists them in SHA256SUMS.txt, so installing, uninstalling and updating no longer needs anonymous repository source access.
      • install.sh now verifies the downloaded binary and uninstaller against SHA256SUMS.txt, installs uninstall.sh next to the binary, and gained --dry-run to print the resolved version and asset URLs without touching the system.
      • nupst update downloads the install script of the resolved release and runs it pinned to that version, and the upgrade changelog is read from the release's changelog.md asset.
      • The npm postinstall script downloads the platform binary from release assets only, verifies its SHA256 checksum, and no longer falls back to repository source URLs.
      • The npm postinstall script reads the version from its own package.json instead of a hardcoded fallback, and times out stalled downloads instead of hanging; the release workflow fails the job when an asset upload does not return 2xx and verifies every published binary afterwards.
      • Documents the anonymous one-liner against releases/download/latest/install.sh plus the API-based tag resolution variant.
      • Installations of v6.0.0 or earlier must re-run the installation one-liner once, because their nupst update still fetches the install script from raw/branch/main, which is no longer readable without a Gitea account.
      • Builds the release notes from changelog.md instead of a non-existent CHANGELOG.md, so releases no longer fall back to the generic default block.
      • Validates every release tag against the same shape in install.sh and ts/release-assets.ts, so a manipulated tag_name or --version argument aborts before any URL is built.
      • Restricts all installer transfers to HTTPS with bounded redirects, cleans up temporary downloads on INT/TERM as well, and stops the running service only after the downloads are verified, so a failed download leaves the running installation untouched.
      • Verifies an already present binary in the npm postinstall path against the release checksums instead of trusting it, and follows 301/302/303/307/308 redirects over HTTPS only.

    Fixes

    • remove NUPST from the system on uninstall (uninstall)
      • uninstall.sh now removes both the /usr/local/bin and /usr/bin symlinks, and removes the installation directory of a binary install instead of only handling legacy git checkouts. nupst uninstall requests the directory removal, a direct run of uninstall.sh asks for it.
    • add npmjs registry to npm publishing configuration (smartconfig)
      • Adds the public npm registry alongside the existing Verdaccio registry.
    Downloads