TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

PSA: Eget That Executable from GitHub

47 pointsby tarasglek9 months ago

9 comments

captn3m08 months ago
Figuring out the “latest” release can happen via the 302 redirect that GitHub offers on releases/latest/ - no API needed. It also works directly for artifact URLs.
__MatrixMan__8 months ago
Glad to see that there&#x27;s a `--verify-sha256=` flag.<p>I prefer hard-coded hashes in my code so that when the file changes, I&#x27;m made aware. I&#x27;ve lost so much time chasing bugs back to a dependency which changed without a version bump and whose hash was checked by a script that just got the hash it was checking at runtime.
duckkg58 months ago
This seems to be inspired by the smelly nerds meme<p><a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;github&#x2F;comments&#x2F;1at9br4&#x2F;i_am_new_to_github_and_i_have_lots_to_say&#x2F;?share_id=PgaydUZlRDobIywviJrnb&amp;utm_content=1&amp;utm_medium=android_app&amp;utm_name=androidcss&amp;utm_source=share&amp;utm_term=1&amp;rdt=60452" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;github&#x2F;comments&#x2F;1at9br4&#x2F;i_am_new_to...</a>
sneak8 months ago
This is effectively giving Microsoft RCE on your computer.<p>We trust github.com and small-time publishers far too much. There’s a reason Debian packages software and runs mirrors.
评论 #41496451 未加载
评论 #41496511 未加载
评论 #41496469 未加载
评论 #41496433 未加载
bitbasher8 months ago
I like the idea, but I can&#x27;t imagine using it for a few reasons.<p>1. There&#x27;s a catch-22. In order to fetch binaries you need to first install eget.<p>2. You need to trust eget to not be (or become) malicious.<p>Perhaps #1 can be resolved by providing it as a proxy service and not an executable. For example, &quot;wget eget.net&#x2F;gopls@latest&quot; which then usings eget on the server to grab&#x2F;cache the binary and send it back.<p>Then again, that would mean putting even more trust in eget.
athorax8 months ago
Not exactly the same, but aqua is a similar tool in this space <a href="https:&#x2F;&#x2F;github.com&#x2F;aquaproj&#x2F;aqua">https:&#x2F;&#x2F;github.com&#x2F;aquaproj&#x2F;aqua</a>
alt1878 months ago
&gt; However, I’m firmly on the side of using GitHub for everything because projects that use alternatives to GitHub are special snowflakes that make everything harder for me as a user.<p>Good.
评论 #41501961 未加载
评论 #41503009 未加载
评论 #41500961 未加载
oalders8 months ago
<a href="https:&#x2F;&#x2F;github.com&#x2F;houseabsolute&#x2F;ubi">https:&#x2F;&#x2F;github.com&#x2F;houseabsolute&#x2F;ubi</a> does a nice job of fetching binaries from GitHub. Just give it a repo and a location to place the binary.<p>ubi --project oalders&#x2F;is --in ~&#x2F;local&#x2F;bin
kayson8 months ago
Similarly, there&#x27;s Obtainium for Android. I love it for open source apps.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;ImranR98&#x2F;Obtainium">https:&#x2F;&#x2F;github.com&#x2F;ImranR98&#x2F;Obtainium</a>
评论 #41498388 未加载