https://zillowe.qzz.io/ Latest insights and updates from the Zillowe Foundation. Thu, 13 Aug 2026 10:17:24 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en All rights reserved 2026, Zillowe Foundation https://zillowe.qzz.io/articles/future-of-installation-scripts https://zillowe.qzz.io/articles/future-of-installation-scripts Mon, 06 Jul 2026 00:00:00 GMT | bash` is a common but dangerous pattern. It grants arbitrary, unvetted execution privileges to a remote script, often requiring sudo. You *cannot* trust a foreign script running on your local machine without reading it first, but for most people that is not the case they just trust whatever the script contains and run it. ## The ZSM Solution [#the-zsm-solution] Zillowe Script Manager (ZSM) introduces a Capability-based Security model for installation scripts. Instead of running imperative shell code, you run a `.zsm` script that declares the permissions it needs. ZSM acts as a complete lifecycle manager. Please note that this is mainly a proof-of-concept and may not be ideal for most applications, want to improve it? [Contribute Here](https://gitlab.com/zillowe/zillwen/zusty/zsm). ### Key Features [#key-features] * **Declarative Permissions:** Scripts must explicitly request access to the network, filesystem, or system configuration. * **Deep Supervision:** Lock external binaries to specific argument patterns (e.g. `require bin: curl --silent`). * **User Approval & Persistence:** Users review and approve specific capabilities before any code runs. Approvals are securely cached based on the script's URL. * **Full Lifecycle Management:** ZSM tracks created files and supports `zsm uninstall` for clean removal, including custom uninstall hooks. * **Small & Portable:** Built with Zig 0.16.0 for zero-dependency, high-performance execution. ## Getting Started [#getting-started] You can install ZSM via [Zoi](/zds/zoi): ```bash zoi install @zillowe/zsm ``` ### Usage [#usage] ZSM can fetch and run scripts natively or via pipes: ```bash # Native execution zsm install https://example.com/install.zsm # Piped execution curl -fsSL https://example.com/install.zsm | zsm ``` ### Script Example [#script-example] ZSM scripts use a declarative format to specify metadata and requirements, followed by safe built-in logic, this is a real example from Zoi `install.zsm`: ```bash title="install.zsm" lineNumbers #!/usr/bin/env zsm # :: name: zoi # :: version: latest # :: url: zillowe.pages.dev/zoi/install.zsm # :: description: Installer for Zoi # :: require bin: tar, zstd # :: perm net: gitlab.com, zillowe.pages.dev # :: perm fs: /tmp, ~/.local/bin GITLAB_PROJECT_ID="71087662" GITLAB_PROJECT_PATH="zillowe/zillwen/zusty/zoi" BIN_NAME="zoi" OS = system.os() ARCH = system.arch_mapped() LATEST_TAG = web.get_json_field("https://gitlab.com/api/v4/projects/${GITLAB_PROJECT_ID}/releases", "tag_name") REPO_BASE_URL="https://gitlab.com/${GITLAB_PROJECT_PATH}/-/releases/${LATEST_TAG}/downloads" TARGET_ARCHIVE="zoi-${OS}-${ARCH}.tar.zst" DOWNLOAD_URL="${REPO_BASE_URL}/${TARGET_ARCHIVE}" web.download("${DOWNLOAD_URL}", "/tmp/${TARGET_ARCHIVE}") run zstd -dc "/tmp/${TARGET_ARCHIVE}" | run tar -xf - -C "/tmp" fs.move("/tmp/zoi", "~/.local/bin/zoi") fs.chmod("~/.local/bin/zoi", "755") ``` Please check out the [docs](/docs/zds/zsm) for more information. ]]> Zaid https://zillowe.qzz.io/articles/zoi https://zillowe.qzz.io/articles/zoi Wed, 25 Feb 2026 00:00:00 GMT Zaid