The installer failed with "Failed to get latest version" when the GitHub
REST API returned 403 due to the anonymous rate limit (60 req/hour, shared
across NAT/CI). Switch the primary lookup to the `/releases/latest` 302
redirect, which doesn't count against the API quota. Keep the API call as
a fallback, and add a RTK_VERSION escape hatch for pinning.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The installer previously ran `tar -xzf` on the downloaded archive with no
pre-extraction verification. A malicious mirror could ship a tarball with
`../` components or absolute paths and write files anywhere on the user's
filesystem (CWE-22).
Add a pre-extraction check that lists archive contents with `tar -tzf`
and rejects any entry whose name starts with `/` or contains a `..` path
component. The check is POSIX-compliant and adds negligible overhead for
the single-binary RTK release tarball.
Covered by scripts/test-install.sh, which exercises one safe archive
and four crafted malicious archives (leading `..`, absolute path,
mid-path `..`, trailing `..`) plus a regression guard that ensures the
check remains in install.sh.
Co-Authored-By: Claude <noreply@anthropic.com>
The current x86_64-unknown-linux-gnu release binary dynamically links against glibc, which causes failures on systems with an older glibc version:
rtk: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.39' not found (required by rtk)
Replace the x86_64-unknown-linux-gnu build target with x86_64-unknown-linux-musl, producing a fully statically-linked binary with no libc dependency.
Fixesrtk-ai/rtk#265 - binary fails on systems with old glibc.
Remove sudo requirement by defaulting to $HOME/.local/bin (XDG standard).
Supports RTK_INSTALL_DIR env var for custom install path.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Closes#77
- install.sh: update REPO to rtk-ai/rtk (was using old fork name)
- INSTALL.md: fix curl URL from /blob/ (returns HTML) to raw URL
- Cargo.toml: update repository field
- Formula/rtk.rb: update all download URLs and tap reference
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
aesoft