Skip to main content

Install

The script installs tesser to ~/.tesser/bin and adds that directory to your shell’s rc file. In a GitHub Actions job, it also appends the directory to GITHUB_PATH, so tesser is on the PATH in the job’s later steps. To install a specific release:
Running the install line again upgrades in place. tesser update installs the latest release over the running binary and restarts the daemon on it; tesser update v0.77.0 installs that release. Before replacing the binary, tesser update runs the downloaded build, and a build that does not run leaves the current binary in place. Tesser’s control plane works with tesser 0.77.0 or later. On an older CLI, every command that reaches the control plane fails with a message that the version is too old, naming the oldest version that still works, and asks you to run tesser update. Pin 0.77.0 or later in CI.

Automatic updates

A tesser command starts a background check for a newer release when the last check is older than the interval in timers. What the check does depends on the install:
  • When the running binary is ~/.tesser/bin/tesser (where the install script puts it) and that directory is writable, the check installs the latest release if you are behind and restarts a running daemon on it, the same as tesser update.
  • Any other install, such as Homebrew, Nix, or a binary you copied elsewhere, is never replaced. Commands print a line naming the newer release and tesser update instead.
  • When the CI environment variable is set to anything other than empty, 0, or false, there is no check at all. CI jobs get the latest release from the install script.
  • TESSER_AUTO_UPDATE=0 turns off the automatic install. The check still runs and commands still print the line about a newer release.
  • tesser update <version> pins that release, and the check stops installing newer ones. A bare tesser update installs the latest release and removes the pin.

Release API

https://install.tesser.sh serves the install script and answers the questions it asks. Every response is plain text. <target> is one of darwin-arm64, linux-x64, linux-x64-baseline (x64 CPUs without AVX2), and linux-arm64. A version or target that does not exist returns 404. A published release never changes. Releases up to v0.76.0 also have a darwin-x64 build. Later releases have no build for Intel Macs, and on an Intel Mac the install script stops with tesser has no build for Intel Macs. On an Apple silicon Mac, the install script picks darwin-arm64 even in a shell running under Rosetta.

How updates are verified

Every release’s manifest is signed with Tesser’s release key, and the public half is compiled into the CLI. tesser update downloads the manifest and its signature, refuses a manifest the key did not sign, and checks the tarball against the sha256 in the signed manifest. Anyone who could change what install.tesser.sh or the download store serves still could not get an installed CLI to update to a build we did not sign. The install script does not check the signature: it trusts the sha256 that install.tesser.sh serves, like any curl | sh installer. To remove that trust from CI, pin the hash as below.

Pin a release in CI

To trust nothing but a hash in your own repository, hardcode the target and the sha256, and check the download against it:
Get the value for <sha256> once from https://install.tesser.sh/v0.77.0/linux-x64/sha.