insmith generates standalone install.sh scripts for CLI tools released on
GitHub Releases. Generated installers discover a release asset, install it, and
verify its provenance with GitHub Artifact Attestations or SHA-256 checksums.
Generate an installer for a conventional GoReleaser-style release:
cd path/to/local/repository
go run github.com/Songmu/insmith/cmd/insmith@latest -wThe repository can also be specified explicitly:
go run github.com/Songmu/insmith/cmd/insmith@latest -w owner/repoFor a release package containing multiple executables:
go run ./cmd/insmith \
--name mytools \
--binary foo \
--binary bar \
owner/repo > install.shGenerated installers support Linux, macOS, and Windows on amd64 and arm64.
Windows installation runs under a POSIX-compatible shell such as Git Bash,
MSYS2, or Cygwin. Installers select name_version_os_arch.tar.gz, .zip,
.exe, or a raw binary from direct GitHub Release download URLs, and accept:
./install.sh -b "$HOME/bin"
BINDIR="$HOME/bin" ./install.sh
./install.sh v1.2.3
./install.sh -d v1.2.3
./install.sh -x -b "$HOME/bin" v1.2.3When OWNER/REPO is omitted, insmith resolves it from the local Git
repository's origin remote. Workflow existence is then checked against the
local worktree for that repository. The default installation directory is
./bin. Generator flags must precede the optional OWNER/REPO argument.
Generated installers accept -d for shlib debug logging and -x for the
shell's command execution trace.
When both archive formats exist, Linux prefers .tar.gz, while macOS and
Windows prefer .zip. The other archive format remains a fallback.
Each binary is prepared with install -m 0755 in a temporary file inside
BINDIR, then atomically renamed over its destination. All configured
binaries are prepared before any destination is replaced.
Generated installers require POSIX sh and standard Unix tools, and can
download with curl, wget, fetch, ftp, Python 3, or Node.js. They
require tar or unzip for the selected archive format. git and a safe
GitHub CLI version with attestation digest support are optional in the default
mode; when unavailable, the installer verifies the release checksum.
All generator options are optional. When omitted, insmith uses the following defaults:
| Option | Default behavior |
|---|---|
--name NAME |
Uses the repository name. |
--binary NAME |
Installs one binary named after --name. May be repeated to install multiple binaries. |
--workflow PATH |
Uses release-build.yaml when it exists; otherwise omits workflow pinning. An empty value (--workflow=) always omits workflow pinning. |
--asset-pattern PATTERN |
Uses {name}_{version}_{os}_{arch}. |
--checksum-pattern PATTERN |
Uses SHA256SUMS. |
--verification POLICY |
Uses attestation-or-checksum. Other policies are attestation, checksum, and none. |
--version |
Generates an installer unless this flag is present; with the flag, prints the insmith version and exits. |
-w |
Writes the generated installer to install.sh, overwriting it if it exists, instead of writing to standard output. Sets mode 0755 on platforms that support POSIX permissions. |
The package name defaults to the repository name and is available to asset
patterns as {name}. Each --binary identifies an executable inside the
selected archive; when omitted, the package name is installed as a single
binary. Asset and checksum patterns may use {name}, {version}, {os}, and
{arch}. A raw, unarchived release asset can install only one binary.
The default verification mode is attestation-or-checksum: an unavailable
attestation capability (including a missing gh/git, gh older than 2.93,
or missing digest flags) falls back to SHA-256 verification. Once attestation
verification is attempted, a failed attestation or unresolved release tag
aborts installation without downgrading to checksums.
Attestation verification explicitly targets github.com, regardless of
GH_HOST, without changing the environment variable.
By default, provenance is also pinned to
OWNER/REPO/.github/workflows/release-build.yaml. Use --workflow PATH for a
differently named release workflow. If the default workflow does not exist,
workflow pinning is omitted. An explicitly specified workflow must exist or
generation fails. --workflow= omits only the workflow constraint; repository,
source commit, and signer commit constraints remain enabled.
insmith [flags] [OWNER/REPO]# Install the latest version. (Install it into ./bin/ by default).
% curl -sfL https://raw.githubusercontent.com/Songmu/insmith/main/install.sh | sh -s
# Specify installation directory ($(go env GOPATH)/bin/) and version.
% curl -sfL https://raw.githubusercontent.com/Songmu/insmith/main/install.sh | sh -s -- -b $(go env GOPATH)/bin [vX.Y.Z]
# In alpine linux (as it does not come with curl by default)
% wget -O - -q https://raw.githubusercontent.com/Songmu/insmith/main/install.sh | sh -s [vX.Y.Z]
# go install
% go install github.com/Songmu/insmith/cmd/insmith@latestSee CONTRIBUTING.md for development setup, testing, and implementation notes.