fix(install): resolve latest version via GitHub API on Windows
The PowerShell installer scraped the tag from the /releases/latest redirect via $resp.BaseResponse.ResponseUri, which only exists on Windows PowerShell 5.1. On PowerShell 7 (the default iwr|iex runtime) BaseResponse is an HttpResponseMessage with no ResponseUri, so the value was null, the regex never matched, and the script died with 'could not resolve latest version' even though zot is public. Resolve via api.github.com/.../releases/latest instead (tag_name is returned directly, identical across PS 5.1 and 7+), add status-aware error messages (404 / 401-403 / other), and drop the stale private-repo note. Verified on PowerShell 7.7.
- commit
- 872a312a065a3e4fc90c030f674aaf4e2f5363d9
- author
- patriceckhart · · 2026-05-29 09:26 UTC
- parent
- edbbcc1
- signature
- unsigned
- refs
- tag: v0.2.2
1 file · +34 -12
M install.ps1 +34 -12
| @@ -13,9 +13,10 @@ | |||
| 13 | 13 | # and moves it into $ZOT_PREFIX (defaults to $HOME\bin, added to PATH | |
| 14 | 14 | # via the User environment if missing). | |
| 15 | 15 | # | |
| 16 | - | # While the repo is private, set $env:GITHUB_TOKEN to a PAT with | |
| 17 | - | # `contents:read` scope; the script uses it for every download. Once | |
| 18 | - | # the repo goes public, the token becomes optional. | |
| 16 | + | # $env:GITHUB_TOKEN is optional for the public repo. Set it to a PAT | |
| 17 | + | # with `contents:read` scope if you hit GitHub API rate limits (or if | |
| 18 | + | # you are installing from a private fork); the script then uses it for | |
| 19 | + | # the version lookup and every download. | |
| 19 | 20 | ||
| 20 | 21 | ||
| 21 | 22 | [CmdletBinding()] | |
| @@ -58,20 +59,41 @@ if ($arch -eq "arm64") { | |||
| 58 | 59 | } | |
| 59 | 60 | ||
| 60 | 61 | # ---- resolve version ---- | |
| 62 | + | # | |
| 63 | + | # Resolve "latest" through the GitHub releases API. This works the same | |
| 64 | + | # on Windows PowerShell 5.1 and PowerShell 7+, unlike scraping the | |
| 65 | + | # /releases/latest redirect target: on PS7 the final URL lives at | |
| 66 | + | # $resp.BaseResponse.RequestMessage.RequestUri while on PS5.1 it is | |
| 67 | + | # $resp.BaseResponse.ResponseUri, and relying on either breaks on the | |
| 68 | + | # other runtime. The API returns the tag directly, so there is nothing | |
| 69 | + | # to scrape. | |
| 61 | 70 | ||
| 62 | 71 | if ($Version -eq "latest") { | |
| 63 | - | if ($headers.ContainsKey("Authorization")) { | |
| 64 | - | $api = Invoke-RestMethod -Headers $headers "https://api.github.com/repos/$owner/$repo/releases/latest" | |
| 65 | - | $Version = $api.tag_name | |
| 66 | - | } else { | |
| 67 | - | $resp = Invoke-WebRequest -UseBasicParsing -MaximumRedirection 5 ` | |
| 68 | - | "https://github.com/$owner/$repo/releases/latest" | |
| 69 | - | if ($resp.BaseResponse.ResponseUri -match '/tag/([^/]+)') { | |
| 70 | - | $Version = $Matches[1] | |
| 72 | + | $apiUrl = "https://api.github.com/repos/$owner/$repo/releases/latest" | |
| 73 | + | # GitHub's API wants a User-Agent; Invoke-RestMethod sets one, but be | |
| 74 | + | # explicit so corporate proxies that strip it don't trip a 403. | |
| 75 | + | $apiHeaders = @{} + $headers | |
| 76 | + | if (-not $apiHeaders.ContainsKey("User-Agent")) { $apiHeaders["User-Agent"] = "zot-installer" } | |
| 77 | + | $apiHeaders["Accept"] = "application/vnd.github+json" | |
| 78 | + | ||
| 79 | + | try { | |
| 80 | + | $api = Invoke-RestMethod -UseBasicParsing -Headers $apiHeaders -Uri $apiUrl | |
| 81 | + | } catch { | |
| 82 | + | $status = $null | |
| 83 | + | try { $status = [int]$_.Exception.Response.StatusCode } catch {} | |
| 84 | + | if ($status -eq 404) { | |
| 85 | + | Die "no published release found for $owner/$repo (the repo may have no releases yet)" | |
| 86 | + | } elseif ($status -eq 401 -or $status -eq 403) { | |
| 87 | + | Die "GitHub API request was rejected ($status). If the repo is private, set `$env:GITHUB_TOKEN to a PAT with contents:read; otherwise you may be rate-limited (try again later or set `$env:GITHUB_TOKEN)." | |
| 71 | 88 | } else { | |
| 72 | - | Die "could not resolve latest version (set `$env:GITHUB_TOKEN if the repo is private)" | |
| 89 | + | Die "could not resolve latest version: $($_.Exception.Message)" | |
| 73 | 90 | } | |
| 74 | 91 | } | |
| 92 | + | ||
| 93 | + | $Version = $api.tag_name | |
| 94 | + | if (-not $Version) { | |
| 95 | + | Die "could not resolve latest version: GitHub API returned no tag_name for $owner/$repo" | |
| 96 | + | } | |
| 75 | 97 | } | |
| 76 | 98 | ||
| 77 | 99 | if (-not $Version.StartsWith("v")) { $Version = "v$Version" } | |
| @@ -13,9 +13,10 @@ | |||||
| 13 | # and moves it into $ZOT_PREFIX (defaults to $HOME\bin, added to PATH | 13 | # and moves it into $ZOT_PREFIX (defaults to $HOME\bin, added to PATH | ||
| 14 | # via the User environment if missing). | 14 | # via the User environment if missing). | ||
| 15 | # | 15 | # | ||
| 16 | - | # While the repo is private, set $env:GITHUB_TOKEN to a PAT with | 16 | + | # $env:GITHUB_TOKEN is optional for the public repo. Set it to a PAT |
| 17 | - | # `contents:read` scope; the script uses it for every download. Once | 17 | + | # with `contents:read` scope if you hit GitHub API rate limits (or if |
| 18 | - | # the repo goes public, the token becomes optional. | 18 | + | # you are installing from a private fork); the script then uses it for |
| 19 | + | # the version lookup and every download. | |||
| 19 | 20 | ||||
| 20 | 21 | ||||
| 21 | [CmdletBinding()] | 22 | [CmdletBinding()] | ||
| @@ -58,20 +59,41 @@ if ($arch -eq "arm64") { | |||||
| 58 | } | 59 | } | ||
| 59 | 60 | ||||
| 60 | # ---- resolve version ---- | 61 | # ---- resolve version ---- | ||
| 62 | + | # | |||
| 63 | + | # Resolve "latest" through the GitHub releases API. This works the same | |||
| 64 | + | # on Windows PowerShell 5.1 and PowerShell 7+, unlike scraping the | |||
| 65 | + | # /releases/latest redirect target: on PS7 the final URL lives at | |||
| 66 | + | # $resp.BaseResponse.RequestMessage.RequestUri while on PS5.1 it is | |||
| 67 | + | # $resp.BaseResponse.ResponseUri, and relying on either breaks on the | |||
| 68 | + | # other runtime. The API returns the tag directly, so there is nothing | |||
| 69 | + | # to scrape. | |||
| 61 | 70 | ||||
| 62 | if ($Version -eq "latest") { | 71 | if ($Version -eq "latest") { | ||
| 63 | - | if ($headers.ContainsKey("Authorization")) { | 72 | + | $apiUrl = "https://api.github.com/repos/$owner/$repo/releases/latest" |
| 64 | - | $api = Invoke-RestMethod -Headers $headers "https://api.github.com/repos/$owner/$repo/releases/latest" | 73 | + | # GitHub's API wants a User-Agent; Invoke-RestMethod sets one, but be |
| 65 | - | $Version = $api.tag_name | 74 | + | # explicit so corporate proxies that strip it don't trip a 403. |
| 66 | - | } else { | 75 | + | $apiHeaders = @{} + $headers |
| 67 | - | $resp = Invoke-WebRequest -UseBasicParsing -MaximumRedirection 5 ` | 76 | + | if (-not $apiHeaders.ContainsKey("User-Agent")) { $apiHeaders["User-Agent"] = "zot-installer" } |
| 68 | - | "https://github.com/$owner/$repo/releases/latest" | 77 | + | $apiHeaders["Accept"] = "application/vnd.github+json" |
| 69 | - | if ($resp.BaseResponse.ResponseUri -match '/tag/([^/]+)') { | 78 | + | |
| 70 | - | $Version = $Matches[1] | 79 | + | try { |
| 80 | + | $api = Invoke-RestMethod -UseBasicParsing -Headers $apiHeaders -Uri $apiUrl | |||
| 81 | + | } catch { | |||
| 82 | + | $status = $null | |||
| 83 | + | try { $status = [int]$_.Exception.Response.StatusCode } catch {} | |||
| 84 | + | if ($status -eq 404) { | |||
| 85 | + | Die "no published release found for $owner/$repo (the repo may have no releases yet)" | |||
| 86 | + | } elseif ($status -eq 401 -or $status -eq 403) { | |||
| 87 | + | Die "GitHub API request was rejected ($status). If the repo is private, set `$env:GITHUB_TOKEN to a PAT with contents:read; otherwise you may be rate-limited (try again later or set `$env:GITHUB_TOKEN)." | |||
| 71 | } else { | 88 | } else { | ||
| 72 | - | Die "could not resolve latest version (set `$env:GITHUB_TOKEN if the repo is private)" | 89 | + | Die "could not resolve latest version: $($_.Exception.Message)" |
| 73 | } | 90 | } | ||
| 74 | } | 91 | } | ||
| 92 | + | ||||
| 93 | + | $Version = $api.tag_name | |||
| 94 | + | if (-not $Version) { | |||
| 95 | + | Die "could not resolve latest version: GitHub API returned no tag_name for $owner/$repo" | |||
| 96 | + | } | |||
| 75 | } | 97 | } | ||
| 76 | 98 | ||||
| 77 | if (-not $Version.StartsWith("v")) { $Version = "v$Version" } | 99 | if (-not $Version.StartsWith("v")) { $Version = "v$Version" } | ||