bashdep

Minimal, zero-dependency bash dependency manager. Declare URLs; bashdep downloads them into lib/ and keeps installs idempotent via a per-directory .bashdep.lock. No registry, no runtime — just curl (or wget).

Quick start

1. Vendor bashdep into your repo (pinned release, verified against its published checksum — recommended for reproducibility):

mkdir -p lib
curl -fsSLo lib/bashdep https://github.com/Chemaclass/bashdep/releases/latest/download/bashdep
curl -fsSLo checksum https://github.com/Chemaclass/bashdep/releases/latest/download/checksum
( cd lib && shasum -a 256 -c ../checksum ) && chmod +x lib/bashdep

Prefer the bleeding edge? Grab the main branch instead (unversioned, no checksum):

curl -fsSLo lib/bashdep https://raw.githubusercontent.com/Chemaclass/bashdep/main/bashdep
chmod +x lib/bashdep

2. Declare your dependencies in a .bashdep file (one URL per line; # comments allowed; @dev suffix routes to lib/dev/; optional #sha256=<hex> verifies the download):

https://github.com/TypedDevs/bashunit/releases/download/0.17.0/bashunit
https://github.com/Chemaclass/create-pr/releases/download/0.6/create-pr
https://github.com/Chemaclass/bash-dumper/releases/download/0.1/dumper.sh@dev
https://example.com/pinned.sh#sha256=e3b0c44298fc1c149afbf4c8996fb924...

3. Install:

./lib/bashdep install

That's it. The first run downloads everything and writes .bashdep.lock. Re-runs skip already-installed deps; bumping a URL version re-downloads only that entry. Commit .bashdep.lock to lock versions across collaborators.

Everyday commands:

./lib/bashdep list # what's installed (path + source URL)
./lib/bashdep doctor # detect lockfile drift
./lib/bashdep clean --dry-run # preview orphan removal
./lib/bashdep --help # all commands and flags

Enable tab completion: source <(./lib/bashdep completion bash) (or zsh).

Or source it from a script

Prefer a programmatic setup (custom dirs, inline arrays)? Source bashdep and call the same functions:

#!/bin/bashset -euo pipefail
source lib/bashdep
bashdep::install_from # reads ./.bashdep

See the API reference for bashdep::setup, bashdep::install, and friends.

Exit codes for CI

Every command returns a meaningful, capped-at-255 count, so it drops into CI as-is:

./lib/bashdep doctor ||echo"lockfile drift: $? issue(s)"# 0 = clean
./lib/bashdep install ||echo"$? download(s) failed"

install returns the failure count, doctor the issue count, clean the number of orphans it could not remove, and uninstall the count of names not found. See Behavior.

Why bashdep?

• Idempotent installs via per-directory .bashdep.lock.
• Parallel downloads — dependencies fetch concurrently (tune with --jobs=N, bashdep::setup jobs=N, or BASHDEP_JOBS; default 4, 1 for sequential).
• Optional integrity checks — pin a dependency with #sha256=<hex> and bashdep verifies the download before recording it.
• Dev/prod separation via the @dev URL suffix (lib/ vs lib/dev/).
• curl or wget — uses whichever is installed.
• File-driven, array-driven, or CLI — install_from, install, or ./lib/bashdep <command> (with bash/zsh tab completion).
• Lifecycle commands — list, uninstall, clean, doctor, self_update, completion.
• Modes — force, dry-run, silent, verbose.

Documentation

• API reference — the CLI plus install, install_from, setup, list, uninstall, clean, doctor, self_update, completion, version.
• Behavior — lockfile rules, dev dependencies, checksum verification, parallel downloads, error handling, gotchas.
• Releasing — how maintainers cut a new tagged release with release.sh.
• Contributing — project layout, test conventions, coding guidelines.

Development

make deps # Install bashunit (test runner)
make check # Full gate: test + ShellCheck + editorconfig
make test# Run the suite (BASHUNIT_FLAGS=--simple for quiet)
make sa # ShellCheck
make lint # editorconfig-checker
make pre_commit/install

See CONTRIBUTING for the full guide.