Context
The install script (install.sh) calls the GitHub API (https://api.github.com/repos/krkn-chaos/krknctl/releases/tags/${VERSION}) to read release metadata and get the expected SHA256 for the tarball. Unauthenticated API use is limited to 60 requests/hour per IP, so installs fail with rate-limit errors in CI or when many users run the script.
Solution
-
Release workflow (build.yaml): After building the tarballs, add a step that runs sha256sum on them, writes the result to checksums.txt, and uploads checksums.txt as a release asset.
-
Install script (install.sh): For checksums, first download checksums.txt from the release asset URL (e.g. .../releases/download/${VERSION}/checksums.txt), which is served from the CDN and not rate-limited. If the file is missing or the hash cannot be read (e.g. old releases), fall back to the existing GitHub API call and support an optional GITHUB_TOKEN to raise the rate limit.
-
Install script (version): For “latest” version, use curl -w '%{redirect_url}' and set the version from the redirect URL (e.g. VERSION="${REDIRECT_URL##*/}") instead of curl -I and sed.
Result: new releases use the CDN for checksums and avoid the API; older releases still work via the API.
Context
The install script (install.sh) calls the GitHub API (https://api.github.com/repos/krkn-chaos/krknctl/releases/tags/${VERSION}) to read release metadata and get the expected SHA256 for the tarball. Unauthenticated API use is limited to 60 requests/hour per IP, so installs fail with rate-limit errors in CI or when many users run the script.
Solution
Release workflow (build.yaml): After building the tarballs, add a step that runs sha256sum on them, writes the result to checksums.txt, and uploads checksums.txt as a release asset.Install script (install.sh): For checksums, first download checksums.txt from the release asset URL (e.g. .../releases/download/${VERSION}/checksums.txt), which is served from the CDN and not rate-limited. If the file is missing or the hash cannot be read (e.g. old releases), fall back to the existing GitHub API call and support an optional GITHUB_TOKEN to raise the rate limit.Install script (version): For “latest” version, use curl -w '%{redirect_url}' and set the version from the redirect URL (e.g. VERSION="${REDIRECT_URL##*/}") instead of curl -I and sed.Result: new releases use the CDN for checksums and avoid the API; older releases still work via the API.