ghr: baixar versions anteriors

A toolkit for GitHub releases.
Highlights
- Reinstall-ready ghr list output (#228): ghr list now defaults to printing shell-ready ghr install commands that preserve each tool's stored source configuration, pinned tag, and install options. Use --tags for compact reinstall arguments, --ids for install IDs, --full for the detailed report, and --json for structured output.
- Minisign key generation and repository provisioning (#216, #217): ghr minisign generate creates a Minisign keypair in-process (backed by cataggar/minizign) and provisions MINISIGN_SECRET_KEY in GitHub Actions, with owner-only local file permissions and overwrite protection (--force to replace existing remote secrets).
- Unkeyed installs and downloads of Minisign-signed releases (#210): ghr install and ghr download now proceed when a release publishes .minisig sidecars but no Minisign public key is supplied, noting that Minisign was not verified while keeping all other verification checks active and failing closed whenever a key is provided.
- Improved documentation site (#218, #221, #222, #223, #229): the documentation at cataggar.github.io/ghr has been refreshed with a streamlined Quick start guide, shared sidebar navigation, and copyable command blocks.
- Zig 0.17.0 upgrade and Windows publish retries (#208, #212): ghr is now built with official Zig 0.17.0 (Linux 5.10+, macOS 15.0+, Windows 10+) and automatically retries transient Windows AccessDenied/FileBusy errors during unit publication and rollback.
Full changelog: v0.8.1...v0.9.0
Install
Linux and macOS:
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.9.0 sh
Windows (PowerShell):
$env:GHR_VERSION = 'v0.9.0'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
See Installation for package managers and uninstall instructions.

A toolkit for GitHub releases.
Highlights
- Executable symlink aliases (#206): ghr install now exposes archive-provided commands such as llvm-readelf and llvm-strip, preserving their command names and original relative symlinks. Aliases work with --bin, command ownership, transactional replacement, and uninstall. Discovery stays within the extracted package, skips absolute, escaping, broken, or cyclic links, and never searches symlinked directories recursively.
Full changelog: v0.8.0...v0.8.1
Install:
pipx install ghr-bin==0.8.1
uv tool install ghr-bin==0.8.1
winget install ghr --version 0.8.1
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.8.1 sh
$env:GHR_VERSION = 'v0.8.1'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.8.1 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights
- GitHub artifact attestations: ghr download and ghr install now verify GitHub-native build provenance, checking the attestation's Sigstore trust chain, Rekor inclusion proof, and workflow identity, then reporting the source repository and workflow. (#166, #168, #169, #170)
- Signatures no longer expire: Authenticode certificates are now validated at the time of signing rather than against the wall clock. Previously a correctly signed binary became unverifiable once the timestamp authority's own certificate expired — ghr download git-lfs/git-lfs/git-lfs-windows-v3.7.1.exe failed with CertificateExpired. The trust root set is no longer clock-filtered either. (#175, fixes #172)
- Correct signer attribution: Authenticode and Sigstore chain verification reported the last certificate walked instead of the leaf, so a GitHub-signed binary was credited to Microsoft ID Verified Code Signing PCA 2021. (#174)
- Hardened DER parsing: Every DER structure parsed from untrusted input — X.509 certificates, PKCS#7 SignedData, RFC 3161 tokens — is now fully bounds-checked, so a truncated or hostile encoding is reported as an ordinary verification failure rather than crashing. (#171, fixes #167)
- Full changelog: v0.6.9...v0.7.0
Install:
pipx install ghr-bin==0.7.0
uv tool install ghr-bin==0.7.0
winget install ghr --version 0.7.0
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.7.0 sh
$env:GHR_VERSION = 'v0.7.0'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.7.0 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights
- Cross-filesystem installs: Download caches and tool storage can now live on different devices. Staging occurs beside the destination, preventing CrossDevice/EXDEV failures.
- Safer upgrades: Existing installs are retained through a recoverable backup transaction and restored if replacement fails.
- Reliable Wasm coexistence: Independently installed Wasm modules are preserved without modifying the live installation before commit, and legacy transaction backups are recovered automatically.
Note
When upgrading from 0.6.8 or earlier with cache and tool storage on different filesystems, use a one-time same-filesystem cache override because the currently installed version performs the update:
GHR_CACHE_DIR="$HOME/.cache/ghr" ghr install cataggar/ghr@v0.6.9 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0
Install:
pipx install ghr-bin==0.6.9
uv tool install ghr-bin==0.6.9
winget install ghr --version 0.6.9
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.6.9 sh
$env:GHR_VERSION = 'v0.6.9'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.6.9 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights
- Safer archive installs: ghr install now exposes executables only from the shallowest archive level containing runnable candidates, keeping nested firmware and data files such as QEMU's pc-bios images off PATH while preserving nested-only and multi-architecture packages. (#156)
- New project site: cataggar.github.io/ghr is now built with merjs and includes the ghr overview plus articles about the toolkit, installable WASM apps, and the WASI petstore. (#152, #153, #154)
- Full changelog: v0.6.6...v0.6.7
Install:
pipx install ghr-bin==0.6.7
uv tool install ghr-bin==0.6.7
winget install ghr --version 0.6.7
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.6.7 sh
$env:GHR_VERSION = 'v0.6.7'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.6.7 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights
- Support SHA-512 aggregate/sidecar checksum files. Some releases (e.g. caddyserver/caddy) publish checksums.txt with 128-hex SHA-512 digests rather than SHA-256, despite the generic filename. ghr previously assumed any *checksum* file was SHA-256, so every entry silently failed to parse and installs aborted with checksum file 'X' has no entry for 'Y' even though the file did cover the asset. ghr now detects SHA-256 vs SHA-512 per entry (GNU and BSD formats) and also recognizes .sha512/.sha512sum(s)/SHA512SUMS sidecar and aggregate file names. (#149, fixes #148)
Full changelog: v0.6.5...v0.6.6
Install:
pipx install ghr-bin==0.6.6
uv tool install ghr-bin==0.6.6
winget install ghr --version 0.6.6
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.6.6 sh
$env:GHR_VERSION = 'v0.6.6'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.6.6 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights
- Fixed bare-binary command name derivation for <name>-<os>-<arch> assets. Installing a repo whose release assets follow the <name>-<os>-<arch> naming convention (e.g. mer-macos-aarch64 from justrach/merjs) previously linked the binary under the repo name instead of its own name, so ghr install justrach/merjs linked merjs even though the shipped binary is mer. ghr now recognizes this ordering (as well as cosign-linux-amd64-style names) and links the correct command. (#145)
Full changelog: v0.6.4...v0.6.5
Install:
pipx install ghr-bin==0.6.5
uv tool install ghr-bin==0.6.5
winget install ghr --version 0.6.5
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.6.5 sh
$env:GHR_VERSION = 'v0.6.5'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.6.5 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights
- Wasm modules install as independent per-module units. Each wasm module installs to tools/<owner>/<repo>/<stem>/ with its own tag, while archives stay repo-level. So different releases of the same repo coexist — e.g. ghr install cataggar/wabt@v3.0.0-dev.19 (the wabt archive) and ghr install cataggar/wabt@petstore-0.1.0 (the petstore wasm components) no longer clobber each other. ghr list shows each module as owner/repo/stem@tag. (#140)
- ghr uninstall <owner/repo> leaves wasm modules in place. Plain <owner/repo> now removes only the repo-level (archive) install; remove an individual wasm module with <owner/repo/stem>. (#141)
Full changelog: v0.6.3...v0.6.4
Install:
pipx install ghr-bin==0.6.4
uv tool install ghr-bin==0.6.4
winget install ghr --version 0.6.4
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.6.4 sh
$env:GHR_VERSION = 'v0.6.4'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.6.4 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Install:
pipx install ghr-bin==0.6.2
uv tool install ghr-bin==0.6.2
winget install ghr --version 0.6.2
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.6.2 sh
$env:GHR_VERSION = 'v0.6.2'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.6.2 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Install:
pipx install ghr-bin==0.5.1
uv tool install ghr-bin==0.5.1
winget install ghr --version 0.5.1
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.5.1 sh
$env:GHR_VERSION = 'v0.5.1'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.5.1 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights since v0.4.1
- ghr link / ghr unlink from WSL. Link Windows-PATH executables (.exe/.cmd/.bat) into WSL with ghr link <name>, and remove them with ghr unlink, using a lowercase tool-dir layout. A clearer "not installed" error covers the missing-target case. (#110, #112, #114)
- Windows installer. New install.ps1 one-liner for Windows; self-install now pins pre-release tags. (#113)
- ghr path add. Renamed from ghr path ensure; the install scripts now run it automatically to add ghr's bin dir to PATH. (#115)
- Broader asset auto-selection. Recognize Rust target triples (riscv64, gnu/musl) when picking a release asset. (#117)
- Clearer verification output. Verification timestamps print as ISO datetimes, and the per-PE Authenticode log lines on zip downloads collapse into a single summary. (#109, #111)
Full changelog: v0.4.1...v0.5.0
Install:
pipx install ghr-bin==0.5.0
uv tool install ghr-bin==0.5.0
winget install ghr --version 0.5.0
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.5.0 sh
$env:GHR_VERSION = 'v0.5.0'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.5.0 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Install:
pipx install ghr-bin==0.3.2
uv tool install ghr-bin==0.3.2
winget install ghr --version 0.3.2
ghr install cataggar/ghr@v0.3.2 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Install:
pipx install ghr-bin==0.3.1
uv tool install ghr-bin==0.3.1
winget install ghr --version 0.3.1
ghr install cataggar/ghr@v0.3.1 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights since v0.2.1
- Sigstore + minisign + Authenticode verification. Every install/download checks any sigstore bundle, minisign sidecar, Authenticode signature, and SHA-256 sidecar published by the upstream release, fail-closed on mismatch. Pass a minisign key inline per-spec (ghr install owner/repo@tag <pubkey>) or via --minisign; narrow skip flags (--skip-sigstore, --skip-minisign, --skip-authenticode, --skip-checksum) cover the bypass cases. (#80, #81, #88)
- Multi-spec installs and downloads. ghr install A B C and ghr download A B C share a single HTTP client + auth context. New composite actions cataggar/ghr/actions/install@v1 and cataggar/ghr/actions/download@v1 cache the resulting binaries across CI runs. (#83)
- Signed, reproducible releases. Linux/macOS .tar.gz archives are byte-reproducible from the tagged commit, Windows .zip archives use deterministic forward-slash paths after an Authenticode-strip pass, and every archive ships *.sigstore.json and *.minisig sidecars signed by the release workflow. (#76, #82, #86, #89, #93)
- ghr list surfaces the minisign key it actually trusted at install time, so the entire line is directly pasteable as ghr install args on future upgrades. (#94)
- Bug fixes. Recover the executable bit on extracted .zip assets (#87); fix Windows-only CI smoke failures (#92).
Install:
pipx install ghr-bin==0.3.0
uv tool install ghr-bin==0.3.0
winget install ghr --version 0.3.0
ghr install cataggar/ghr@v0.3.0 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

A toolkit for GitHub releases.
Highlights
- CLI help follows the Zig convention: every subcommand now accepts a positional help (e.g. ghr download help, ghr install help). The previous -h / --help flags have been removed. (#71)
- New dedicated usage printers for install, uninstall, and list, plus a Run 'ghr <COMMAND> help' to show help for a specific command hint in the top-level usage and README.md. (#71)
- The unimplemented ghr upgrade stub has been removed from the binary and the help/README.md. (#70)
Install:
pipx install ghr-bin==0.2.1
uv tool install ghr-bin==0.2.1
winget install ghr --version 0.2.1
brew install cataggar/ghr/ghr

ghr 0.2.0
A toolkit for GitHub releases.
New
- ghr download subcommand for cross-platform HTTPS downloads (#56)
- owner/repo/file[@tag] syntax to pick a specific asset by name in install / download (#59)
- ghr path ensure (and ghr path bin|tools|cache) to manage ghr's directories and add the bin dir to your user PATH, with nushell support (#43, #44, #45, #60)
- version and help as top-level subcommands (replaces the --version flag) (#48, #63)
- Rebranded as a toolkit for GitHub releases; docs split into doc/README.md (#60, #62, #64)
Verification
- SHA256 + Sigstore verification of release assets (#57)
- minisign verification with fail-closed sidecar detection and a pre-flight check (#66, #67)
- minisign verification example added to the README (#68)
Asset selection / install fixes
- Stop matching win inside darwin on Windows (#42)
- Reject foreign-arch assets to avoid wrong-arch installs (#55, #58)
- Smarter heuristics for multi-asset releases (#54)
- Support bare executables — .exe and extensionless binaries (#49)
- Handle self-replacement on Windows (#51)
Full changelog: v0.1.6...v0.2.0
Install
pipx install ghr-bin==0.2.0
uv tool install ghr-bin==0.2.0
winget install ghr -v 0.2.0
See doc/README.md for download, install, directories, uninstall, and verification details.