Add a new --min-age-days flag

When set, `ubi` will only download a release that is at least X days old. This is useful for
mitigating supply chain attacks, especially for projects that use GitHub's immutable releases feature.

This also includes some refactoring to better use serde. This eliminates the need for per-forge
`Release` types.

This was mostly: 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: autarch

Cargo.lock

@@ -15,6 +15,7 @@ anyhow = { version = "1.0.100", default-features = false }
 async-trait = { version = "0.1.89", default-features = false }
 binstall-tar = { version = "0.4.42", default-features = false }
 bzip2 = { version = "0.6.1" }
+chrono = { version = "0.4", default-features = false, features = ["serde", "clock"] }
 document-features = { version = "0.2" }
 # Used in some test code which can't use test_log.
 env_logger = { version = "0.11.8", default-features = false }

Cargo.toml

@@ -1,3 +1,9 @@
+## 0.9.0
+
+- Added a new `--min-age-days` flag that tells `ubi` to only consider releases at least that old.
+  This is useful for mitigating supply chain attacks, especially for projects that use GitHub's
+  immutable releases feature. GH #145.
+
 ## 0.8.4 2025-11-01
 
 - This is the same as 0.8.3, but I had to publish this with a new tag because of a failed experiment

Changes.md

@@ -72,7 +72,8 @@ fn cmd() -> Command {
                 .requires("project")
                 .help(concat!(
                     "The tag to download. Defaults to the latest release.",
-                    " This can only be passed with `--project`."
+                    " This can only be passed with `--project`. You cannot pass this when",
+                    " `--url` or `--min-age-days` are passed.",
                 )),
         )
         .arg(
@@ -84,7 +85,8 @@ fn cmd() -> Command {
                     "The url of the file to download. This can be provided instead of a project or",
                     " tag. This will not use the forge site's API, so you will never hit its API",
                     " limits. With this parameter, you do not need to set a token env var except for",
-                    " private repos. You cannot pass this when `--project` or `--tag` are passed."
+                    " private repos. You cannot pass this when `--project`, `--tag`, or `--min-age-days`",
+                    " are passed."
                 )),
         )
         .arg(
@@ -132,6 +134,19 @@ fn cmd() -> Command {
                     "  `--rename-exe-to` are passed.",
                 )),
         )
+        .arg(
+            Arg::new("min-age-days")
+                .long("min-age-days")
+                .value_parser(clap::value_parser!(u32))
+                .requires("project")
+                .conflicts_with_all(["tag", "url"])
+                .help(concat!(
+                    "Minimum age in days for releases. Only releases at least this many days old",
+                    " will be installed. This is useful for mitigating supply chain attacks. It's",
+                    " especially useful for projects that use GitHub's immutable releases",
+                    " feature. You cannot pass this with --tag or --url.",
+                )),
+        )
         .arg(
             Arg::new("matching")
                 .long("matching")
@@ -146,13 +161,13 @@ fn cmd() -> Command {
         )
         .arg(
             Arg::new("matching-regex")
-            .long("matching-regex")
-            .short('r')
-            .help(concat!(
-                "A regular expression string that will be matched against release filenames before",
-                " matching against your OS/arch. If the pattern yields a single match, that release",
-                " will be selected. If no matches are found, this will result in an error.",
-            )),
+                .long("matching-regex")
+                .short('r')
+                .help(concat!(
+                    "A regular expression string that will be matched against release filenames before",
+                    " matching against your OS/arch. If the pattern yields a single match, that release",
+                    " will be selected. If no matches are found, this will result in an error.",
+                )),
         )
         .arg(
             Arg::new("forge")
@@ -273,6 +288,9 @@ fn make_ubi<'a>(
     if let Some(url) = matches.get_one::<String>("api-base-url") {
         builder = builder.api_base_url(url);
     }
+    if let Some(days) = matches.get_one::<u32>("min-age-days") {
+        builder = builder.min_age_days(*days);
+    }
 
     Ok((builder.build()?, None))
 }

ubi-cli/src/main.rs

@@ -14,6 +14,7 @@ anyhow.workspace = true
 async-trait.workspace = true
 binstall-tar.workspace = true
 bzip2.workspace = true
+chrono.workspace = true
 document-features.workspace = true
 fern = { workspace = true, optional = true }
 flate2.workspace = true

ubi/Cargo.toml

@@ -38,6 +38,7 @@ pub struct UbiBuilder<'a> {
     is_musl: Option<bool>,
     api_base_url: Option<&'a str>,
     forge: Option<ForgeType>,
+    min_age_days: Option<u32>,
 }
 
 impl<'a> UbiBuilder<'a> {
@@ -60,8 +61,9 @@ impl<'a> UbiBuilder<'a> {
         self
     }
 
-    /// Set the tag to download. By default the most recent release is downloaded. You cannot set
-    /// this with the `url` option.
+    /// Set the tag to download. By default the most recent release is downloaded.
+    ///
+    /// You cannot set this with the `url` or `min_age_days` options.
     #[must_use]
     pub fn tag(mut self, tag: &'a str) -> Self {
         self.tag = Some(tag);
@@ -73,7 +75,8 @@ impl<'a> UbiBuilder<'a> {
     /// to set a token env var except when downloading a release from a private repo when the URL is
     /// set.
     ///
-    /// You must set this or set `project`, but not both.
+    /// You must set this or set `project`, but not both. You cannot set this with the `tag` or
+    /// `min_age_days` options.
     #[must_use]
     pub fn url(mut self, url: &'a str) -> Self {
         self.url = Some(url);
@@ -142,6 +145,17 @@ impl<'a> UbiBuilder<'a> {
         self
     }
 
+    /// Set the minimum age in days for releases. Only releases at least this many days old will be
+    /// installed. This is useful for mitigating supply chain attacks. It's especially useful for
+    /// projects that use GitHub's immutable releases feature.
+    ///
+    /// You cannot set this with the `tag` or `url` options.
+    #[must_use]
+    pub fn min_age_days(mut self, days: u32) -> Self {
+        self.min_age_days = Some(days);
+        self
+    }
+
     /// Set a token to use for API requests. If this is not set, then `ubi` will look for a token in
     /// the appropriate env var:
     ///
@@ -233,6 +247,19 @@ impl<'a> UbiBuilder<'a> {
                 "You cannot set rename_exe_to and enable extract_all"
             ));
         }
+        if let Some(days) = self.min_age_days {
+            if self.url.is_some() {
+                return Err(anyhow!("You cannot set min_age_days with url"));
+            }
+            if self.tag.is_some() {
+                return Err(anyhow!("You cannot set min_age_days with tag"));
+            }
+            if days == 0 {
+                return Err(anyhow!(
+                    "min_age_days must be a positive number (greater than 0)"
+                ));
+            }
+        }
 
         let platform = self.determine_platform()?;
 
@@ -267,6 +294,7 @@ impl<'a> UbiBuilder<'a> {
             ),
             installer,
             reqwest_client()?,
+            self.min_age_days,
         ))
     }
 
@@ -492,4 +520,18 @@ mod test {
     ) {
         assert_eq!(super::expect_exe_stem_name(exe, project_name), expect);
     }
+
+    #[test]
+    fn min_age_days_zero_validation() {
+        let result = UbiBuilder::new()
+            .project("houseabsolute/ubi")
+            .min_age_days(0)
+            .build();
+
+        assert!(result.is_err());
+        assert!(result
+            .unwrap_err()
+            .to_string()
+            .contains("min_age_days must be a positive number"));
+    }
 }