This release rebuilds how resterm updates itself. Downloads are now verified end to end against checksums served by the GitHub release API, the new binary has to prove it is the right release before it replaces the current one.
Verified self-updates
resterm --updatenow verifies every download against the sha256 digest the GitHub release API publishes for each asset. There is no separate checksum file to fetch anymore - the expected hash arrives with the release metadata and the downloaded binary must match it exactly.- Verification is mandatory. A missing digest, a size mismatch or a checksum mismatch aborts the update and leaves the current install untouched.
- As a final check, the downloaded binary is executed with
--versionand must report the release it claims to be before it is moved into place. - The new binary is staged next to the current one and swapped in with an atomic rename. On Windows the update now installs in place instead of waiting for a restart: the previous executable stays beside the new one as
resterm.exe.oldand is cleaned up by the next update once no process is still running it.
Safer installs
install.shandinstall.ps1verify the downloaded binary against the release API digest before installing and refuse to install when the checksum does not match.
Atomic releases
- Release binaries are built for all platforms first, checked for completeness and attached. The
latestrelease can no longer be seen with missing binaries or checksums.
Better changelogs in the terminal
resterm --check-updateandresterm --updaterender release notes as formatted text: headings, nested lists, code blocks, emphasis, quotes and links, wrapped to terminal width. Colors are applied when the terminal supports them and degrade to structured plain text when it does not.