Jaroslav Beneš
dff14ec3e8
Three gaps allowed an unverified binary to reach a trusted location: - The ffmpeg ZIP fallback logged a warning on checksum mismatch and installed anyway (the 7z path already aborted). Abort instead. - The yt-dlp auto-update path downloaded and renamed the binary over the verified one with no checksum at all. Verify against the official SHA2-256SUMS like the first-install path, and use atomic os.replace. - The yt-dlp first install streamed the download directly to the trusted path and only verified afterwards; a crash in between left an unverified executable to be run on next launch. Download to .part and os.replace only after verification. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
SageTube
A watch-first YouTube client for the desktop — search, browse channels and playlists, follow subscriptions, and stream videos in an embedded mpv player, with full yt-dlp download capability inherited from YTSage.
SageTube is a fork of YTSage by oop7 (MIT). The original YTSage documentation is preserved at docs/UPSTREAM_README.md.
Status
Under active development. See the upstream README for the downloader feature set, which remains fully functional.
License
MIT — see LICENSE.