zpi v0.2.0 — Safer installs, reliable state

zpi v0.2.0 is a reliability and integrity release focused on making package operations predictable—even when downloads, extraction, or state updates fail.

Highlights

Integrity-checked packages

• Verifies every downloaded archive against repository-provided SHA-256 metadata before extraction.
• Rejects incomplete or malformed package metadata.
• Uses atomic temporary downloads with retries, timeouts, and safe argument arrays instead of eval.

Transactional package operations

• Installs and updates through staging directories before atomically replacing the active package.
• Rolls back package files if the installed-package state cannot be committed.
• Makes removals recoverable and updates installed.json and .addons atomically.
• Serializes mutating commands with a transaction lock and recovers stale locks.

Hardened archive handling

• Rejects path traversal, absolute paths, backslashes, symbolic links, unsupported entry types, and files outside the expected package directory.
• Limits archives to 200 entries and 10 MiB uncompressed.
• Confirms that the expected Zsh function exists before installation.

A much stronger first-run experience

• Removes the bootstrap dependency on zini with a built-in INI reader.
• Supports custom installation paths, including paths containing spaces.
• Provides a built-in fallback theme and installs the bundled classic theme when available.
• Allows help and version to work before initialization.

Updates and search

• Correctly compares dotted versions such as 1.9 and 1.10.
• Preserves checksum metadata throughout update processing.
• Adds UTF-8-safe search URL encoding and uses the shared downloader for searches.

Requirements

Install jq, unzip with zipinfo, either curl, wget, or wget2, and either sha256sum or shasum.

The repository API must return a sha256 value for each package. The official Zrep service has already been updated and backfilled.

Verification

This release includes isolated bootstrap and installation regression suites covering initialization, malicious archives, checksum failures, transactional rollback, dotted-version updates, metadata validation, and stale-lock recovery.

Full changelog: v0.1.0...v0.2.0