@hoardodile/rclone-bin

中文

Static rclone 1.75.0 binary as an npm package. The package is only a few KB; the binary is downloaded from GitHub Releases at install time because the upstream static-build sites are unreliable to depend on directly. This is the same install-time-download model as @hoardodile/7z-bin, @hoardodile/ffmpeg-bin and ffmpeg-static.

Platforms

Platform	Binary
win32-x64	rclone.exe
darwin-x64	rclone
darwin-arm64	rclone
linux-x64	rclone
linux-arm64	rclone

The binaries are statically linked builds from the official rclone release (rclone/rclone), version-pinned and SHA-256 verified against the repo's upstream SHA256SUMS.

The release assets are the raw, uncompressed binaries (the size on the release page is the real on-disk size — no tar/gz wrapper).

Unsupported platforms (win32-ia32, win32-arm64, linux-ia32, linux-arm) resolve to null; consumers should degrade to a PATH rclone.

Usage

const rclone = require("@hoardodile/rclone-bin") // path or null

• RCLONE_BIN_PATH — overrides the returned path.
• RCLONE_BINARIES_URL — overrides the download base URL.
• Install verifies SHA-256 (assets.json) and requires rclone 1.75 (major.minor) in the rclone version output.

Runtime download (Electron)

Skip bundling binaries: let your app download them from the release on demand, verify, and chmod:

https://github.com/hoardodile/rclone-bin/releases/download/v<version>/rclone-<platform>-<arch>

• No authentication required; the asset is the raw rclone binary (or rclone.exe on Windows).
• Checksums: assets.json in the package, or SHA256SUMS.txt on the release. Verify the SHA-256, then chmod +x on macOS/Linux.

Building the assets + releasing

assets.json ships with empty sha256 placeholders until the assets are first built — the script records the real SHA-256 of each repacked artifact.

1. Update VERSION (and per-platform filenames, if the upstream naming changed) in scripts/build-assets.mjs
2. Bump package.json version (defines the release tag)
3. Run npm run build:assets (idempotent; --skip-upload builds locally only and writes the real assets.json)
4. Commit (at minimum assets.json + the version), push, then push the v<version> tag. The tag triggers the release workflow: assets are built/uploaded to the GitHub release and the package is published to npm automatically (Trusted Publishing / OIDC — no registry token in Actions).

One-time npm-side setup (per package, npm >= 11.11, owner account, asks for a 2FA code once):

npm trust github @hoardodile/rclone-bin --file release.yml --repo hoardodile/rclone-bin --allow-publish

Note: the main-branch CI run for the bump commit can transiently fail its install/verify jobs while the tag-triggered release workflow is still uploading assets (404 on the v<version> download URL) — rerun the failed jobs once the release workflow finished:

gh run rerun --repo hoardodile/rclone-bin --failed <run-id>

License

MIT (scripts). The rclone binary is copyright its author and licensed MIT; it is not shipped in the package — consult the upstream license. Attribution is recorded by scripts/build-assets.mjs and the release notes.