Safety Portability and Limitations

Safety, Portability, and Limitations

Safety model

Noob mode

Before a destructive operation:

binman analyze
binman backup
binman uninstall --dry-run NAME

Use --dry-run where available, read the summary, and do not paste device paths from examples into flash just because they look confident.

Pro mode

BinMan is transparent rather than magically safe:

• Remote scripts are not cryptographically verified before installation.
• Verification checks existence and executability, not runtime correctness.
• Restore and bundle archives do not contain external package-manager state, runtimes, Docker images, or shell configuration.
• The child process cannot refresh the parent shell's command hash table.
• --system, Docker/Podman, flashing, networking, sudo, and GitHub actions can change external state.
• “Atomic-ish” staging reduces partial writes but is not a transaction across payloads, metadata, and shell state.

Automatic backups are off by default. Set BINMAN_AUTO_BACKUP=1 for mutating flows that should create rollback snapshots. Keep archives somewhere other than the directory being repaired when disk space is under pressure.

Portability

Target	Position
Linux	Primary development target
WSL	Expected to work where Linux integrations are available
macOS	Experimental; BSD/GNU differences may matter
Bash	Required to run BinMan itself
Zsh/Fish	Supported as calling shells
BusyBox/BSD Unix	Not certified

Core features use Bash, awk, sed, find, sort, mktemp, install, and path utilities. Specialized features additionally use sudo, systemd, lsblk, network tools, Docker/Podman, or Pi-specific layouts.

Known limitations

The current implementation has a few honest rough edges:

1. binman verify NAME currently runs the all-items path; positional filtering is not wired through the public dispatcher.
2. Help mentions update --git, but the option is not connected to the public update parser.
3. Help advertises --restore FILE; use binman restore FILE instead.
4. Help lists tui, while the working entry point is binman with no action.
5. Old or externally copied directories inside the app store may be detected as candidate apps even when they lack valid BinMan metadata.
6. Optional dependencies change feature availability; missing tools are not replaced by pretend success.

These are implementation mismatches, not secret promises. Test the actual command and capture its exit status before automating around one.