@hoardodile/restic-bin

中文

Static restic 0.19.1 binary as an npm package. The package is only a few KB; the binary is downloaded from GitHub Releases at install time because the upstream static-build sites are unreliable to depend on directly. This is the same install-time-download model as @hoardodile/7z-bin, @hoardodile/ffmpeg-bin and ffmpeg-static.

Platforms

Platform	Binary
win32-x64	restic.exe
darwin-x64	restic
darwin-arm64	restic
linux-x64	restic
linux-arm64	restic

The binaries are statically linked builds from the official restic release (restic/restic), version-pinned and SHA-256 verified against the repo's upstream SHA256SUMS.

The release assets are the raw, uncompressed binaries (the size on the release page is the real on-disk size — no tar/gz wrapper).

Unsupported platforms (win32-ia32, win32-arm64, linux-ia32, linux-arm) resolve to null; consumers should degrade to a PATH restic.

Usage

const restic = require("@hoardodile/restic-bin") // path or null

• RESTIC_BIN_PATH — overrides the returned path.
• RESTIC_BINARIES_URL — overrides the download base URL.
• Install verifies SHA-256 (assets.json) and requires restic 0.19 (major.minor) in the restic version output.

Runtime download (Electron)

Skip bundling binaries: let your app download them from the release on demand, verify, and chmod:

https://github.com/hoardodile/restic-bin/releases/download/v<version>/restic-<platform>-<arch>

• No authentication required; the asset is the raw restic binary (or restic.exe on Windows).
• Checksums: assets.json in the package, or SHA256SUMS.txt on the release. Verify the SHA-256, then chmod +x on macOS/Linux.

Building the assets + releasing

assets.json ships with empty sha256 placeholders until the assets are first built — the script records the real SHA-256 of each repacked artifact.

1. Update VERSION (and per-platform filenames, if the upstream naming changed) in scripts/build-assets.mjs
2. Bump package.json version (defines the release tag)
3. Run npm run build:assets (idempotent; --skip-upload builds locally only and writes the real assets.json)
4. Commit (at minimum assets.json + the version), push, then push the v<version> tag. The tag triggers the release workflow: assets are built/uploaded to the GitHub release and the package is published to npm automatically (Trusted Publishing / OIDC — no registry token in Actions).

One-time npm-side setup (per package, npm >= 11.11, owner account, asks for a 2FA code once):

npm trust github @hoardodile/restic-bin --file release.yml --repo hoardodile/restic-bin --allow-publish

Note: the main-branch CI run for the bump commit can transiently fail its install/verify jobs while the tag-triggered release workflow is still uploading assets (404 on the v<version> download URL) — rerun the failed jobs once the release workflow finished:

gh run rerun --repo hoardodile/restic-bin --failed <run-id>

License

BSD-2-Clause (scripts). The restic binary is copyright its author and licensed BSD-2-Clause; it is not shipped in the package — consult the upstream license. Attribution is recorded by scripts/build-assets.mjs and the release notes.