bashdep

Minimal, zero-dependency bash dependency manager. Declare URLs; bashdep downloads them into lib/ and keeps installs idempotent via a per-directory .bashdep.lock. No registry or runtime. Just curl (or wget).

Quick start

1. Vendor bashdep into your repo (pin the release and verify its published checksum):

mkdir -p lib
curl -fsSLo lib/bashdep https://github.com/Chemaclass/bashdep/releases/latest/download/bashdep
curl -fsSLo checksum     https://github.com/Chemaclass/bashdep/releases/latest/download/checksum
( cd lib && shasum -a 256 -c ../checksum ) && chmod +x lib/bashdep

Prefer the bleeding edge? Grab the main branch instead (unversioned, no checksum):

curl -fsSLo lib/bashdep https://raw.githubusercontent.com/Chemaclass/bashdep/main/bashdep
chmod +x lib/bashdep

2. Declare your dependencies in a .bashdep file (one URL per line; # comments allowed; @dev suffix routes to lib/dev/; optional #sha256=<hex> verifies the download):

https://github.com/TypedDevs/bashunit/releases/download/0.45.0/bashunit#sha256=19983f26299825ff26cfbb90e6b3b6e86fc8044168191d3e8b86f615313a80a9
https://github.com/Chemaclass/create-pr/releases/download/0.6/create-pr
https://github.com/Chemaclass/bash-dumper/releases/download/0.1/dumper.sh@dev

Or let bashdep write the entry and pin its checksum for you: ./lib/bashdep add <url>.

3. Install:

./lib/bashdep install

That's it. The first run downloads everything and writes .bashdep.lock. Re-runs skip already-installed deps; bumping a URL version re-downloads only that entry. Commit .bashdep.lock to lock versions across collaborators.

Everyday commands:

./lib/bashdep list             # what's installed (path + source URL)
./lib/bashdep doctor           # detect lockfile drift
./lib/bashdep clean --dry-run  # preview orphan removal
./lib/bashdep --help           # all commands and flags

Enable tab completion: source <(./lib/bashdep completion bash) (or zsh).

Or source it from a script

Prefer a programmatic setup (custom dirs, inline arrays)? Source bashdep and call the same functions:

#!/bin/bash
set -euo pipefail

source lib/bashdep
bashdep::install_from   # reads ./.bashdep

See the API reference for bashdep::setup, bashdep::install, and friends.

Exit codes for CI

Every command returns a meaningful, capped-at-255 count, so it drops into CI as-is:

./lib/bashdep doctor || echo "lockfile drift: $? issue(s)"   # 0 = clean
./lib/bashdep install || echo "$? download(s) failed"

install returns the failure count, doctor the issue count, clean the number of orphans it could not remove, and uninstall the count of names not found. See Behavior.

Why bashdep?

• Idempotent installs via per-directory .bashdep.lock.
• Parallel downloads: dependencies fetch concurrently (tune with --jobs=N, bashdep::setup jobs=N, or BASHDEP_JOBS; default 4, 1 for sequential).
• Optional integrity checks: pin a dependency with #sha256=<hex> and bashdep verifies the download before recording it.
• Dev/prod separation via the @dev URL suffix (lib/ vs lib/dev/).
• curl or wget: uses whichever is installed.
• File-driven, array-driven, or CLI: install_from, install, or ./lib/bashdep <command> (with bash/zsh tab completion).
• Lifecycle commands: add, list, uninstall, clean, doctor, self_update, completion.
• Modes: force, dry-run, silent, verbose.

Documentation

• API reference: the CLI plus install, install_from, add, setup, list, uninstall, clean, doctor, self_update, completion, version.
• Behavior: lockfile rules, dev dependencies, checksum verification, parallel downloads, error handling, gotchas.
• Releasing: how maintainers cut a new tagged release with release.sh.
• Contributing: project layout, test conventions, coding guidelines.

Development

make test              # Run the suite (installs bashunit on first run)
make check             # Full gate: test + ShellCheck + editorconfig
make sa                # ShellCheck
make lint              # editorconfig-checker
make pre_commit/install
make release/check     # Run checks and preview the next release
make                   # List all targets

See CONTRIBUTING for the full guide.