mediayoinker 0.4.1__tar.gz

mediayoinker-0.4.1/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 Vokuar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

mediayoinker-0.4.1/PKG-INFO

@@ -0,0 +1,40 @@
+Metadata-Version: 2.4
+Name: mediayoinker
+Version: 0.4.1
+Summary: Launcher that installs, updates and runs mediayoink
+Author: Vokuar
+License-Expression: MIT
+Project-URL: Source, https://codeberg.org/mediayoink/mediayoinker.git
+Project-URL: mediayoink, https://codeberg.org/mediayoink/mediayoink.git
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: yt-dlp
+Requires-Dist: gallery-dl
+Requires-Dist: instaloader
+Dynamic: license-file
+
+# mediayoinker
+
+Launcher for mediayoink, one command that picks the right downloader for a URL
+(yt-dlp, gallery-dl or instaloader) and falls through to the next one when a tool
+fails.
+
+```
+pip install mediayoinker
+```
+
+On each run the launcher checks mediayoink's version tags on Codeberg, downloads
+a newer version when one is tagged, and runs it. It also adds a `yoink` command,
+or `myoink` if another `yoink` is already on your PATH.
+
+Each new version is installed only if it carries a valid release signature,
+checked with `ssh-keygen` (built into Windows 10 and later and most Linux systems,
+`pkg install openssh` on Termux). The release key's fingerprint is
+`SHA256:qapp42ORJmsIB23ckGjtSbeiFhrdMmKyY6wXCH0LDUk`. To let pip manage
+mediayoink's versions instead, `pip install mediayoink`.
+
+On Android, inside Termux, `mediayoinker --termux-opener` makes links you share to
+Termux download through mediayoink. If you already have a `termux-url-opener`, add
+`overwrite` to replace it (the old one is backed up) or `append` to keep it and run
+mediayoink after it.

mediayoinker-0.4.1/README.md

@@ -0,0 +1,24 @@
+# mediayoinker
+
+Launcher for mediayoink, one command that picks the right downloader for a URL
+(yt-dlp, gallery-dl or instaloader) and falls through to the next one when a tool
+fails.
+
+```
+pip install mediayoinker
+```
+
+On each run the launcher checks mediayoink's version tags on Codeberg, downloads
+a newer version when one is tagged, and runs it. It also adds a `yoink` command,
+or `myoink` if another `yoink` is already on your PATH.
+
+Each new version is installed only if it carries a valid release signature,
+checked with `ssh-keygen` (built into Windows 10 and later and most Linux systems,
+`pkg install openssh` on Termux). The release key's fingerprint is
+`SHA256:qapp42ORJmsIB23ckGjtSbeiFhrdMmKyY6wXCH0LDUk`. To let pip manage
+mediayoink's versions instead, `pip install mediayoink`.
+
+On Android, inside Termux, `mediayoinker --termux-opener` makes links you share to
+Termux download through mediayoink. If you already have a `termux-url-opener`, add
+`overwrite` to replace it (the old one is backed up) or `append` to keep it and run
+mediayoink after it.

mediayoinker-0.4.1/mediayoinker.egg-info/PKG-INFO

@@ -0,0 +1,40 @@
+Metadata-Version: 2.4
+Name: mediayoinker
+Version: 0.4.1
+Summary: Launcher that installs, updates and runs mediayoink
+Author: Vokuar
+License-Expression: MIT
+Project-URL: Source, https://codeberg.org/mediayoink/mediayoinker.git
+Project-URL: mediayoink, https://codeberg.org/mediayoink/mediayoink.git
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: yt-dlp
+Requires-Dist: gallery-dl
+Requires-Dist: instaloader
+Dynamic: license-file
+
+# mediayoinker
+
+Launcher for mediayoink, one command that picks the right downloader for a URL
+(yt-dlp, gallery-dl or instaloader) and falls through to the next one when a tool
+fails.
+
+```
+pip install mediayoinker
+```
+
+On each run the launcher checks mediayoink's version tags on Codeberg, downloads
+a newer version when one is tagged, and runs it. It also adds a `yoink` command,
+or `myoink` if another `yoink` is already on your PATH.
+
+Each new version is installed only if it carries a valid release signature,
+checked with `ssh-keygen` (built into Windows 10 and later and most Linux systems,
+`pkg install openssh` on Termux). The release key's fingerprint is
+`SHA256:qapp42ORJmsIB23ckGjtSbeiFhrdMmKyY6wXCH0LDUk`. To let pip manage
+mediayoink's versions instead, `pip install mediayoink`.
+
+On Android, inside Termux, `mediayoinker --termux-opener` makes links you share to
+Termux download through mediayoink. If you already have a `termux-url-opener`, add
+`overwrite` to replace it (the old one is backed up) or `append` to keep it and run
+mediayoink after it.

mediayoinker-0.4.1/mediayoinker.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+LICENSE
+README.md
+mediayoinker.py
+pyproject.toml
+mediayoinker.egg-info/PKG-INFO
+mediayoinker.egg-info/SOURCES.txt
+mediayoinker.egg-info/dependency_links.txt
+mediayoinker.egg-info/entry_points.txt
+mediayoinker.egg-info/requires.txt
+mediayoinker.egg-info/top_level.txt
+tests/test_mediayoinker.py

mediayoinker-0.4.1/mediayoinker.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

mediayoinker-0.4.1/mediayoinker.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+mediayoinker = mediayoinker:main

mediayoinker-0.4.1/mediayoinker.egg-info/requires.txt

@@ -0,0 +1,3 @@
+yt-dlp
+gallery-dl
+instaloader

mediayoinker-0.4.1/mediayoinker.egg-info/top_level.txt

@@ -0,0 +1 @@
+mediayoinker

mediayoinker-0.4.1/mediayoinker.py

@@ -0,0 +1,321 @@
+#!/usr/bin/env python3
+"""mediayoinker: installs mediayoink from its Codeberg version tags, keeps it current, runs it.
+
+Each run asks Codeberg for mediayoink's tags and, when the highest version tag
+(v0.5.0 style) is newer than the installed copy, downloads yoink.py as of that tag
+into ~/.yoink/client. Only tagged versions reach users, never untagged commits.
+A download is installed only if yoink.py.sig at the same tag is a valid signature
+from a release key built into this file, checked with `ssh-keygen -Y verify`, so
+someone who takes over the Codeberg account cannot ship code. Offline, or when a
+download is rejected, the installed copy runs as-is. All arguments pass through. The
+downloader tools (yt-dlp, gallery-dl, instaloader) are this package's pip
+dependencies.
+
+It also gives you a short command next to itself: `yoink`, or `myoink` when a
+different `yoink` is already on PATH.
+
+On Termux, `mediayoinker --termux-opener [overwrite|append]` makes the Android
+share sheet download through mediayoink.
+
+Needs Python 3.11+ and only the standard library, so it runs on Windows, Linux
+and Termux.
+"""
+import base64
+import json
+import os
+import re
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+__version__ = "0.4.1"
+
+# Python connects to one address at a time, IPv6 first, so on a network with an
+# IPv6 address but no IPv6 route every update check waited out the timeout before
+# trying IPv4 (13s per run on a phone). Same fix as mediayoink's tool wrapper:
+# IPv4 first, IPv6 kept as a fallback. Only this process; mediayoink runs apart.
+_lookup = socket.getaddrinfo
+socket.getaddrinfo = lambda *a, **k: sorted(_lookup(*a, **k), key=lambda r: r[0] != socket.AF_INET)
+
+REPO = "mediayoink/mediayoink"
+API = os.environ.get("MEDIAYOINKER_API", "https://codeberg.org/api/v1")
+ASSET = "yoink.py"
+VERSION_TAG = re.compile(r"v\d+(\.\d+)*")
+CLIENT = Path.home() / ".yoink" / "client" / ASSET
+
+# Public halves of the keys allowed to sign releases. A list so a replacement key
+# can ship here before the old one is retired.
+TRUSTED_KEYS = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXNHWXV+I3ykFiaZasi0ygPW0i+Idet52D5k21vI7eK",
+]
+SIGNER = "mediayoink-release"
+# Must match the -n given to `ssh-keygen -Y sign`, so a signature made for some
+# other purpose with the same key is not accepted here.
+NAMESPACE = "mediayoink"
+SSH_KEYGEN_HINT = ("Termux: pkg install openssh, Linux: install openssh-client, "
+                   "Windows: add the OpenSSH Client optional feature")
+COMMANDS = ("yoink", "myoink")
+SHIM_MARK = "mediayoinker shim"
+
+# Termux runs ~/bin/termux-url-opener with the shared URL. The opener only holds a
+# marked block calling SHARE_SCRIPT, so appending to someone's own opener works
+# whatever shell it is written in, and reinstalling replaces just the block.
+OPENER = Path.home() / "bin" / "termux-url-opener"
+SHARE_SCRIPT = Path.home() / ".yoink" / "termux-share.sh"
+HINT_SHOWN = Path.home() / ".yoink" / "termux-hint-shown"
+BEGIN, END = "# >>> mediayoinker >>>", "# <<< mediayoinker <<<"
+BLOCK = f'{BEGIN}\nbash "$HOME/.yoink/termux-share.sh" "$1"\n{END}\n'
+TERMUX_BASH = "#!/data/data/com.termux/files/usr/bin/bash\n"
+SHARE = TERMUX_BASH + r'''# Written by `mediayoinker --termux-opener`, replaced each time it runs.
+PICS=/storage/emulated/0/Pictures/mediayoink
+MOVS=/storage/emulated/0/Movies/mediayoink
+LOG=$HOME/.yoink/termux-share.log
+mkdir -p "$PICS" "$MOVS" || exit 1
+cd "$PICS" || exit 1
+mediayoinker "$1" > "$LOG" 2>&1
+saved=$(grep '^  /' "$LOG" | sed 's/^  //')
+
+# Instaloader names files after the post time and dates them with it, which
+# buries them in the gallery. That time goes into the file as a comment (one
+# exiftool run per share, Perl is slow to start on a phone), then the file gets
+# today's date. exiftool rewrites the file, so touch comes after it.
+if command -v exiftool >/dev/null; then
+    args=$PREFIX/tmp/mediayoinker-exiftool.args
+    : > "$args"
+    while IFS= read -r f; do
+        posted=$(basename "$f" | sed -nE 's/^([0-9]{4}-[0-9]{2}-[0-9]{2})_([0-9]{2})-([0-9]{2})-([0-9]{2})_UTC.*/\1 \2:\3:\4 UTC/p')
+        case "$f" in
+            *.jpg|*.mp4) [ -n "$posted" ] && printf '%s\n' -q -overwrite_original "-Comment=Posted $posted" "$f" -execute >> "$args" ;;
+        esac
+    done <<< "$saved"
+    [ -s "$args" ] && exiftool -@ "$args"
+    rm -f "$args"
+fi
+while IFS= read -r f; do
+    [ -n "$f" ] && touch "$f"
+done <<< "$saved"
+
+grep -E '^  .*\.(mp4|mov|mkv|webm)$' "$LOG" | sed 's/^  //' | while IFS= read -r f; do
+    dest="$MOVS/${f#$PICS/}"
+    mkdir -p "$(dirname "$dest")"
+    mv "$f" "$dest"
+done
+
+# The termux-api commands wait for the Termux:API app, so a missing app must not
+# hang the share.
+timeout 20 termux-media-scan -r "$PICS" "$MOVS" >/dev/null 2>&1
+timeout 20 termux-notification -t mediayoink -c "$(tail -3 "$LOG")" >/dev/null 2>&1
+'''
+
+
+def say(msg):
+    print(f"[mediayoinker] {msg}", file=sys.stderr)
+
+
+def parse_version(s):
+    return tuple(int(n) for n in re.findall(r"\d+", s)) or None
+
+
+def file_version(text):
+    m = re.search(r'^__version__ = "([^"]+)"', text, re.M)
+    return parse_version(m.group(1)) if m else None
+
+
+def fetch(url):
+    with urllib.request.urlopen(url, timeout=10) as r:
+        return r.read().decode("utf-8")
+
+
+def fetch_file(path, tag):
+    """Raw bytes of a repo file at a tag. Bytes, because a signature covers exact bytes."""
+    return base64.b64decode(json.loads(fetch(f"{API}/repos/{REPO}/contents/{path}?ref={tag}"))["content"])
+
+
+def signature_problem(data, sig):
+    """None if sig is a release signature over data by a trusted key, else why not."""
+    if sig is None:
+        return "is not signed"
+    keygen = shutil.which("ssh-keygen")
+    if keygen is None:
+        return f"cannot be checked because ssh-keygen is missing ({SSH_KEYGEN_HINT})"
+    with tempfile.TemporaryDirectory() as d:
+        signers = Path(d, "allowed_signers")
+        signers.write_bytes("".join(f"{SIGNER} {k}\n" for k in TRUSTED_KEYS).encode())
+        sigfile = Path(d, "yoink.py.sig")
+        sigfile.write_bytes(sig)
+        r = subprocess.run([keygen, "-Y", "verify", "-f", signers, "-I", SIGNER,
+                            "-n", NAMESPACE, "-s", sigfile], input=data, capture_output=True)
+    if r.returncode == 0:
+        return None
+    why = r.stderr.decode(errors="replace").strip().splitlines()
+    return "failed its signature check" + (f" ({why[0]})" if why else "")
+
+
+def update():
+    have = CLIENT.exists()
+    try:
+        # ponytail: first page of tags only (Codeberg lists newest first); page
+        # through if old version tags ever outnumber one page.
+        tags = [t["name"] for t in json.loads(fetch(f"{API}/repos/{REPO}/tags"))
+                if VERSION_TAG.fullmatch(t["name"])]
+        if not tags:
+            raise ValueError("no version tags published yet")
+        tag = max(tags, key=parse_version)
+        new = parse_version(tag)
+        old = file_version(CLIENT.read_text("utf-8")) if have else None
+        if old is not None and new <= old:
+            return
+        code = fetch_file(ASSET, tag)
+        try:
+            sig = fetch_file(f"{ASSET}.sig", tag)
+        except urllib.error.HTTPError as e:
+            if e.code != 404:
+                raise
+            sig = None
+    except (OSError, ValueError, KeyError) as e:
+        if have:
+            return
+        sys.exit(f"[mediayoinker] cannot install mediayoink: {e!r}")
+    # The file must carry the version its tag names, so a tag on the wrong commit
+    # is never written over the client, and it must be signed by a release key.
+    problem = signature_problem(code, sig)
+    if problem is None and file_version(code.decode("utf-8", errors="replace")) != new:
+        problem = f"does not match its {ASSET} version"
+    if problem:
+        if have:
+            say(f"tag {tag} {problem}, keeping the installed copy")
+            return
+        sys.exit(f"[mediayoinker] tag {tag} {problem}")
+    CLIENT.parent.mkdir(parents=True, exist_ok=True)
+    tmp = CLIENT.with_suffix(".tmp")
+    # bytes as signed: write_text would turn line endings into CRLF on Windows
+    tmp.write_bytes(code)
+    os.replace(tmp, CLIENT)
+    say(f"mediayoink {tag} installed")
+
+
+def is_ours(path):
+    try:
+        return SHIM_MARK in Path(path).read_text("utf-8", errors="ignore")
+    except OSError:
+        return False
+
+
+def ensure_command():
+    me = shutil.which("mediayoinker")
+    if me is None:
+        return  # run as a plain file or `python -m`, nowhere on PATH to put a shim
+    bindir = Path(me).parent
+    for name in COMMANDS:
+        found = shutil.which(name)
+        if found and is_ours(found):
+            return
+        if found:
+            continue
+        if os.name == "nt":
+            shim = bindir / f"{name}.cmd"
+            shim.write_text(f'@rem {SHIM_MARK}\n@"{sys.executable}" -m mediayoinker %*\n')
+        else:
+            shim = bindir / name
+            shim.write_text(f'#!/bin/sh\n# {SHIM_MARK}\nexec "{sys.executable}" -m mediayoinker "$@"\n')
+            shim.chmod(0o755)
+        say(f"you can now run mediayoink as `{name}`")
+        return
+    say(f"{' and '.join(COMMANDS)} are both taken on PATH, keep using `mediayoinker`")
+
+
+def on_termux():
+    return os.environ.get("PREFIX", "").startswith("/data/data/com.termux")
+
+
+def install_termux_opener(mode):
+    if not on_termux():
+        sys.exit("[mediayoinker] --termux-opener only works inside Termux on Android")
+    if mode not in (None, "overwrite", "append"):
+        sys.exit("usage: mediayoinker --termux-opener [overwrite|append]")
+    current = OPENER.read_text("utf-8", errors="replace") if OPENER.exists() else None
+    if current is not None and BEGIN not in current and mode is None:
+        sys.exit(f"[mediayoinker] {OPENER} already exists and is not ours. Run again with:\n"
+                 "  overwrite  back it up and replace it, so shares only go to mediayoink\n"
+                 "  append     keep it and add mediayoink after it, so both run on every share")
+
+    SHARE_SCRIPT.parent.mkdir(parents=True, exist_ok=True)
+    SHARE_SCRIPT.write_text(SHARE, "utf-8")
+    OPENER.parent.mkdir(parents=True, exist_ok=True)
+    if current is None:
+        OPENER.write_text(TERMUX_BASH + BLOCK, "utf-8")
+        say(f"installed {OPENER}")
+    elif BEGIN in current:
+        pattern = re.escape(BEGIN) + r".*?" + re.escape(END) + r"\n?"
+        OPENER.write_text(re.sub(pattern, lambda _: BLOCK, current, count=1, flags=re.S), "utf-8")
+        say(f"updated the mediayoinker block in {OPENER}")
+    elif mode == "overwrite":
+        backup = OPENER.with_name(f"termux-url-opener.{time.strftime('%Y%m%d-%H%M%S')}.bak")
+        shutil.copy2(OPENER, backup)
+        OPENER.write_text(TERMUX_BASH + BLOCK, "utf-8")
+        say(f"replaced {OPENER}, the old one is {backup}")
+    else:
+        OPENER.write_text(current.rstrip("\n") + "\n\n" + BLOCK, "utf-8")
+        say(f"appended to {OPENER}; your existing handling still runs first on every share,"
+            " and an `exit` in it would stop mediayoink from running")
+    OPENER.chmod(0o700)
+
+    if not Path("/storage/emulated/0").is_dir() or not os.access("/storage/emulated/0", os.W_OK):
+        say("Termux cannot write to shared storage yet: run `termux-setup-storage`")
+    if not shutil.which("termux-notification"):
+        say("no notifications or gallery refresh: `pkg install termux-api` and install the Termux:API app")
+    if not shutil.which("exiftool"):
+        say("optional: `pkg install exiftool` to keep each post's date inside the file")
+    say("share a link to Termux to try it; the last run's output is in ~/.yoink/termux-share.log")
+
+
+def termux_hint():
+    """Mention --termux-opener once, the first time mediayoinker runs in Termux."""
+    if not on_termux() or HINT_SHOWN.exists():
+        return
+    if not (OPENER.exists() and BEGIN in OPENER.read_text("utf-8", errors="replace")):
+        say("on Android? `mediayoinker --termux-opener` lets you share links to Termux to download them")
+    HINT_SHOWN.parent.mkdir(parents=True, exist_ok=True)
+    HINT_SHOWN.touch()
+
+
+LAUNCHER_HELP = f"""mediayoinker {__version__} - installs, updates and runs mediayoink.
+
+Launcher commands:
+  mediayoinker --termux-opener [overwrite|append]
+                               Termux on Android only: links shared to Termux
+                               download through mediayoink. With an existing
+                               termux-url-opener, overwrite backs it up and
+                               replaces it, append keeps it and runs mediayoink
+                               after it.
+  mediayoinker <anything else> updates mediayoink if a newer version is tagged,
+                               then runs it with the same arguments (also as
+                               `yoink`, or `myoink` if another yoink is on PATH)
+
+mediayoink's own help follows.
+"""
+
+
+def main():
+    if sys.argv[1:2] == ["--termux-opener"]:
+        install_termux_opener(sys.argv[2] if len(sys.argv) > 2 else None)
+        return
+    if sys.argv[1:2] in (["-h"], ["--help"]):
+        print(LAUNCHER_HELP, file=sys.stderr)
+    update()
+    ensure_command()
+    termux_hint()
+    try:
+        sys.exit(subprocess.call([sys.executable, str(CLIENT), *sys.argv[1:]]))
+    except KeyboardInterrupt:
+        sys.exit(130)
+
+
+if __name__ == "__main__":
+    main()

mediayoinker-0.4.1/pyproject.toml

@@ -0,0 +1,27 @@
+[project]
+name = "mediayoinker"
+dynamic = ["version"]
+description = "Launcher that installs, updates and runs mediayoink"
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Vokuar" }]
+dependencies = ["yt-dlp", "gallery-dl", "instaloader"]
+
+[project.urls]
+Source = "https://codeberg.org/mediayoink/mediayoinker.git"
+mediayoink = "https://codeberg.org/mediayoink/mediayoink.git"
+
+[project.scripts]
+mediayoinker = "mediayoinker:main"
+
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools]
+py-modules = ["mediayoinker"]
+
+[tool.setuptools.dynamic]
+version = {attr = "mediayoinker.__version__"}

mediayoinker-0.4.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

mediayoinker-0.4.1/tests/test_mediayoinker.py

@@ -0,0 +1,89 @@
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+import mediayoinker as my
+
+pytestmark = pytest.mark.skipif(shutil.which("ssh-keygen") is None, reason="needs ssh-keygen")
+
+CODE = b'__version__ = "9.9.9"\nprint("hi")\n'
+
+
+def sign(key, data, tmp, namespace=my.NAMESPACE):
+    f = tmp / "payload"
+    f.write_bytes(data)
+    # ssh-keygen keeps an existing .sig (and still exits 0) instead of overwriting
+    (tmp / "payload.sig").unlink(missing_ok=True)
+    subprocess.run(["ssh-keygen", "-q", "-Y", "sign", "-f", key, "-n", namespace, f],
+                   check=True, capture_output=True)
+    return (tmp / "payload.sig").read_bytes()
+
+
+def make_key(tmp, name):
+    key = tmp / name
+    subprocess.run(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", key], check=True)
+    return key, " ".join(Path(f"{key}.pub").read_text().split()[:2])
+
+
+@pytest.fixture
+def key(tmp_path, monkeypatch):
+    key, pub = make_key(tmp_path, "release")
+    monkeypatch.setattr(my, "TRUSTED_KEYS", [pub])
+    return key
+
+
+def test_good_signature_passes(key, tmp_path):
+    assert my.signature_problem(CODE, sign(key, CODE, tmp_path)) is None
+
+
+def test_rejects_tampered_unsigned_wrong_namespace_and_untrusted_key(key, tmp_path):
+    sig = sign(key, CODE, tmp_path)
+    assert "failed" in my.signature_problem(CODE + b"#", sig)
+    assert my.signature_problem(CODE, None) == "is not signed"
+    assert "failed" in my.signature_problem(CODE, sign(key, CODE, tmp_path, namespace="other"))
+    other, _ = make_key(tmp_path, "other")
+    assert "failed" in my.signature_problem(CODE, sign(other, CODE, tmp_path))
+
+
+def test_missing_ssh_keygen_is_a_problem(key, tmp_path, monkeypatch):
+    sig = sign(key, CODE, tmp_path)
+    monkeypatch.setattr(my.shutil, "which", lambda _: None)
+    assert "ssh-keygen is missing" in my.signature_problem(CODE, sig)
+
+
+def fake_codeberg(monkeypatch, files):
+    monkeypatch.setattr(my, "fetch", lambda url: '[{"name": "v9.9.9"}]')
+
+    def fetch_file(path, tag):
+        if path not in files:
+            raise my.urllib.error.HTTPError("u", 404, "Not Found", None, None)
+        return files[path]
+    monkeypatch.setattr(my, "fetch_file", fetch_file)
+
+
+def test_update_installs_exact_signed_bytes(key, tmp_path, monkeypatch):
+    fake_codeberg(monkeypatch, {"yoink.py": CODE, "yoink.py.sig": sign(key, CODE, tmp_path)})
+    monkeypatch.setattr(my, "CLIENT", tmp_path / "client" / "yoink.py")
+    my.update()
+    assert my.CLIENT.read_bytes() == CODE
+
+
+def test_update_keeps_installed_copy_when_unsigned(key, tmp_path, monkeypatch, capsys):
+    fake_codeberg(monkeypatch, {"yoink.py": CODE})
+    monkeypatch.setattr(my, "CLIENT", tmp_path / "yoink.py")
+    my.CLIENT.write_bytes(b'__version__ = "1.0.0"\n')
+    my.update()
+    assert my.CLIENT.read_bytes() == b'__version__ = "1.0.0"\n'
+    assert "is not signed, keeping the installed copy" in capsys.readouterr().err
+
+
+def test_update_refuses_first_install_when_tampered(key, tmp_path, monkeypatch):
+    fake_codeberg(monkeypatch, {"yoink.py": CODE + b"#", "yoink.py.sig": sign(key, CODE, tmp_path)})
+    monkeypatch.setattr(my, "CLIENT", tmp_path / "yoink.py")
+    with pytest.raises(SystemExit, match="failed its signature check"):
+        my.update()
+    assert not my.CLIENT.exists()