x-cmd/release

Central repository for all x-cmd release artifacts.

x-cmd is a POSIX shell standard library — a foundation for shell scripting that includes built-in utility tools and a self-hosted package manager module (x pkg). It runs on bash/dash/zsh across Linux, macOS, and WSL, with no sudo required.

Main repo: x-cmd/x-cmd | Website: x-cmd.com

The source repo x-cmd/x-cmd follows the same mirroring principle and is also available on Codeberg and Gitee.

Why a dedicated release repo?

Git-based sync

Release artifacts are stored directly in a git repository. This means you can sync the entire release set with standard git operations — git clone, git pull, git fetch — no special tooling required.

Small packages, git-friendly

Individual x-cmd packages are typically 1–5 MB (around 2–3 MB each). At this size, storing binaries in git is practical and avoids the overhead of a separate artifact registry.

Beyond GitHub Releases

Relying solely on GitHub Releases would create a single point of failure — subject to GitHub's availability, bandwidth limits, and rate limiting. A git-based approach is platform-agnostic.

Multi-mirror — tamper-proof by design

The repo is mirrored across three independent platforms. This is not just for availability — it provides tamper resistance:

• Every mirror holds an identical copy of all artifacts, including cryptographic checksums (sum/, index.yml).
• If any single platform is compromised, users can verify integrity by comparing against the other two mirrors.
• No single platform operator can silently alter release artifacts without detection.
• Users can git clone from any mirror and cross-check commit hashes and checksums.

Platform	URL
GitHub	https://github.com/x-cmd/release
Codeberg	https://codeberg.org/x-cmd/release
Gitee	https://gitee.com/x-cmd/release

How to verify: Clone from two different mirrors and compare:

git clone https://github.com/x-cmd/release.git   mirror-a
git clone https://codeberg.org/x-cmd/release.git  mirror-b
diff <(cd mirror-a && git rev-parse HEAD) <(cd mirror-b && git rev-parse HEAD)

If the commit hashes match, the artifacts are untampered.

Portable and extensible

Because everything is just git, the release system is easy to extend and adapt:

• Add more mirrors — Need a new region or platform? Just push to another git host. No tooling changes required.
• Private mirrors — Organizations can maintain internal mirrors for air-gapped or self-hosted environments. Clone once, serve internally.
• No vendor lock-in — The entire release set is a standard git repo. Migrate to any git hosting provider at any time.

Structure

index.yml              Version index with checksums, dates, and changelogs
dist/
  └── v{version}/
      ├── allinone.tgz           Minimal bootstrap package
      ├── full.tgz               Full package bundle
      ├── x-cmd_{v}_all.apk      Alpine Linux package (since v0.9.6)
      ├── x-cmd_{v}_all.deb      Debian/Ubuntu package (since v0.9.6)
      ├── x-cmd_{v}_all.rpm      Fedora/RHEL package (since v0.9.6)
      └── x-cmd_{v}_all.pkg.tar.zst  Arch Linux package (since v0.9.6)
sum/                   Per-file integrity checksums (SHA-512)

Package formats (v0.9.6+)

Starting from v0.9.6, native packages are provided for major Linux distributions:

Format	Distribution	Install
.apk	Alpine Linux	apk add x-cmd_0.9.6_all.apk
.deb	Debian, Ubuntu	dpkg -i x-cmd_0.9.6_all.deb
.rpm	Fedora, RHEL, CentOS	rpm -i x-cmd_0.9.6_all.rpm
.pkg.tar.zst	Arch Linux	pacman -U x-cmd_0.9.6_all.pkg.tar.zst

Earlier versions (pre-v0.9.6) ship only allinone.tgz and full.tgz.

Usage

# Clone the release repo
git clone https://github.com/x-cmd/release.git

# Or use a mirror
git clone https://codeberg.org/x-cmd/release.git
git clone https://gitee.com/x-cmd/release.git

License

Apache License 2.0 — Copyright Li Junhao 李均豪 and X-CMD Team. See LICENSE.