ghr 0.5.0

A toolkit for GitHub releases.

Highlights since v0.4.1

• ghr link / ghr unlink from WSL. Link Windows-PATH executables (.exe/.cmd/.bat) into WSL with ghr link <name>, and remove them with ghr unlink, using a lowercase tool-dir layout. A clearer "not installed" error covers the missing-target case. (#110, #112, #114)
• Windows installer. New install.ps1 one-liner for Windows; self-install now pins pre-release tags. (#113)
• ghr path add. Renamed from ghr path ensure; the install scripts now run it automatically to add ghr's bin dir to PATH. (#115)
• Broader asset auto-selection. Recognize Rust target triples (riscv64, gnu/musl) when picking a release asset. (#117)
• Clearer verification output. Verification timestamps print as ISO datetimes, and the per-PE Authenticode log lines on zip downloads collapse into a single summary. (#109, #111)

Full changelog: v0.4.1...v0.5.0

Install:

pipx install ghr-bin==0.5.0
uv tool install ghr-bin==0.5.0
winget install ghr --version 0.5.0
curl -fsSL https://raw.githubusercontent.com/cataggar/ghr/main/install.sh | GHR_VERSION=v0.5.0 sh
$env:GHR_VERSION = 'v0.5.0'; iwr -useb https://raw.githubusercontent.com/cataggar/ghr/main/install.ps1 | iex
ghr install cataggar/ghr@v0.5.0 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

ghr 0.4.1

A toolkit for GitHub releases.

Install:

pipx install ghr-bin==0.4.1
uv tool install ghr-bin==0.4.1
winget install ghr --version 0.4.1
ghr install cataggar/ghr@v0.4.1 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

ghr 0.4.0

A toolkit for GitHub releases.

Highlights:

• Added .deb asset support for install and extraction workflows.
• Improved Debian package handling so Linux launcher shims are preferred during install.
• Fixes the real Linux ARM package case for releases such as AzureAD/microsoft-authentication-cli.

Install:

pipx install ghr-bin==0.4.0
uv tool install ghr-bin==0.4.0
winget install ghr --version 0.4.0
ghr install cataggar/ghr@v0.4.0 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

ghr 0.3.2

A toolkit for GitHub releases.

Highlights:

• Fresh installs now create tool, bin, and cache directories recursively.
• Added an install.sh bootstrap path for Linux and macOS.
• Refreshed the README and install guidance.

Install:

pipx install ghr-bin==0.3.2
uv tool install ghr-bin==0.3.2
winget install ghr --version 0.3.2
ghr install cataggar/ghr@v0.3.2 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

ghr 0.3.1

A toolkit for GitHub releases.

Highlights:

• Improved install/extract diagnostics with path context for easier troubleshooting.
• Replaced the Unicode ellipsis with ASCII in user-facing output.
• Updated release docs to include an install example.

Install:

pipx install ghr-bin==0.3.1
uv tool install ghr-bin==0.3.1
winget install ghr --version 0.3.1
ghr install cataggar/ghr@v0.3.1 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

ghr 0.3.0

A toolkit for GitHub releases.

Highlights since v0.2.1

• Sigstore + minisign + Authenticode verification. Every install/download checks any sigstore bundle, minisign sidecar, Authenticode signature, and SHA-256 sidecar published by the upstream release, fail-closed on mismatch. Pass a minisign key inline per-spec (ghr install owner/repo@tag <pubkey>) or via --minisign; narrow skip flags (--skip-sigstore, --skip-minisign, --skip-authenticode, --skip-checksum) cover the bypass cases. (#80, #81, #88)
• Multi-spec installs and downloads. ghr install A B C and ghr download A B C share a single HTTP client + auth context. New composite actions cataggar/ghr/actions/install@v1 and cataggar/ghr/actions/download@v1 cache the resulting binaries across CI runs. (#83)
• Signed, reproducible releases. Linux/macOS .tar.gz archives are byte-reproducible from the tagged commit, Windows .zip archives use deterministic forward-slash paths after an Authenticode-strip pass, and every archive ships *.sigstore.json and *.minisig sidecars signed by the release workflow. (#76, #82, #86, #89, #93)
• ghr list surfaces the minisign key it actually trusted at install time, so the entire line is directly pasteable as ghr install args on future upgrades. (#94)
• Bug fixes. Recover the executable bit on extracted .zip assets (#87); fix Windows-only CI smoke failures (#92).

Install:

pipx install ghr-bin==0.3.0
uv tool install ghr-bin==0.3.0
winget install ghr --version 0.3.0
ghr install cataggar/ghr@v0.3.0 RWSbsumpaHb+N3KCEt/EUXQ5y6Kkk8r/zCb5Z4jhEuEX8x2/U5wr5QC0

ghr 0.2.1

A toolkit for GitHub releases.

Highlights

• CLI help follows the Zig convention: every subcommand now accepts a positional help (e.g. ghr download help, ghr install help). The previous -h / --help flags have been removed. (#71)
• New dedicated usage printers for install, uninstall, and list, plus a Run 'ghr <COMMAND> help' to show help for a specific command hint in the top-level usage and README.md. (#71)
• The unimplemented ghr upgrade stub has been removed from the binary and the help/README.md. (#70)

Install:

pipx install ghr-bin==0.2.1
uv tool install ghr-bin==0.2.1
winget install ghr --version 0.2.1

ghr 0.2.0

A toolkit for GitHub releases.

New

• ghr download subcommand for cross-platform HTTPS downloads (#56)
• owner/repo/file[@tag] syntax to pick a specific asset by name in install / download (#59)
• ghr path ensure (and ghr path bin|tools|cache) to manage ghr's directories and add the bin dir to your user PATH, with nushell support (#43, #44, #45, #60)
• version and help as top-level subcommands (replaces the --version flag) (#48, #63)
• Rebranded as a toolkit for GitHub releases; docs split into doc/README.md (#60, #62, #64)

Verification

• SHA256 + Sigstore verification of release assets (#57)
• minisign verification with fail-closed sidecar detection and a pre-flight check (#66, #67)
• minisign verification example added to the README (#68)

Asset selection / install fixes

• Stop matching win inside darwin on Windows (#42)
• Reject foreign-arch assets to avoid wrong-arch installs (#55, #58)
• Smarter heuristics for multi-asset releases (#54)
• Support bare executables — .exe and extensionless binaries (#49)
• Handle self-replacement on Windows (#51)

Full changelog: v0.1.6...v0.2.0

Install

pipx install ghr-bin==0.2.0
uv tool install ghr-bin==0.2.0
winget install ghr -v 0.2.0

See doc/README.md for download, install, directories, uninstall, and verification details.

ghr 0.1.6

Install tools from GitHub releases.

Install:

uv tool install ghr-bin==0.1.6

Or via winget:

winget install ghr -v 0.1.6

ghr 0.1.5

Fix Windows install flows: CDN downloads, zip extraction, and PyPI wheels.

Changes

• Fix duplicate User-Agent header: Use Zig's headers.user_agent override instead of putting User-Agent in extra_headers. Zig's HTTP client was emitting both user-agent: zig/0.16.0 and the custom User-Agent: ghr/..., which Azure CDN rejected as an invalid header. Added a regression test. Fixes #28.
• Fix zip extraction for Windows backslash paths: PowerShell's Compress-Archive creates zip entries with backslashes. Normalize path separators before matching so nested installer files resolve correctly on Windows.
• Fix PyPI wheel build for Windows .zip assets: build_wheels.py previously only looked for .tar.gz artifacts and returned 404 on Windows wheels. It now tries both .zip and .tar.gz.

Install:

uv tool install ghr-bin==0.1.5