From 8c7e5008be675004603538c7b668d3ab8846cd35 Mon Sep 17 00:00:00 2001
From: Juan Antonio Osorio <ozz@stacklok.com>
Date: Mon, 14 Sep 2026 13:42:17 +0300
Subject: [PATCH] Remove gh runtime download dependency

---
 README.md           |  2 +-
 Taskfile.yaml       | 20 ++++++++++----------
 docs/DEVELOPMENT.md |  2 +-
 docs/MACOS.md       |  2 +-
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index cb097da..182adc2 100644
--- a/README.md
+++ b/README.md
@@ -65,7 +65,7 @@ VM. When the agent exits, you review the diff and accept or reject each file.
 - Linux with KVM support (`/dev/kvm` must be accessible), or macOS with Hypervisor.framework (Apple Silicon)
 - [Go 1.26+](https://go.dev/dl/)
 - [Task](https://taskfile.dev/) (task runner)
-- [GitHub CLI (`gh`)](https://cli.github.com/) (for downloading pre-built runtime artifacts)
+- [curl](https://curl.se/) (for downloading pre-built runtime artifacts)
 - An API key for your agent (e.g. `ANTHROPIC_API_KEY` for Claude Code)
 
 ### Install from Release
diff --git a/Taskfile.yaml b/Taskfile.yaml
index d33b7b1..5fd978d 100644
--- a/Taskfile.yaml
+++ b/Taskfile.yaml
@@ -124,24 +124,24 @@ tasks:
     cmds:
       - |
         mkdir -p internal/infra/vm/runtimebin
-        gh release download {{.GOMICROVM_VERSION}} --repo stacklok/go-microvm --dir internal/infra/vm/runtimebin/ --clobber --pattern 'go-microvm-runtime-*.tar.gz'
         archive=""
         for os in "{{.HOST_OS}}" "{{.HOST_OS_ALT}}"; do
           for arch in "{{.HOST_ARCH}}" "{{.HOST_ARCH_ALT}}"; do
             candidate="internal/infra/vm/runtimebin/go-microvm-runtime-${os}-${arch}.tar.gz"
-            if [ -f "$candidate" ]; then
+            url="https://github.com/stacklok/go-microvm/releases/download/{{.GOMICROVM_VERSION}}/go-microvm-runtime-${os}-${arch}.tar.gz"
+            if curl --fail --location --retry 3 --output "$candidate" "$url"; then
               archive="$candidate"
               break 2
             fi
+            rm -f "$candidate"
           done
         done
         if [ -z "$archive" ]; then
-          echo "no runtime archive found in internal/infra/vm/runtimebin"
-          ls -1 internal/infra/vm/runtimebin/go-microvm-runtime-*.tar.gz || true
+          echo "no runtime archive available for {{.HOST_OS}}/{{.HOST_ARCH}}"
           exit 1
         fi
         tar -xzf "$archive" -C internal/infra/vm/runtimebin/ --strip-components=1
-        rm -f internal/infra/vm/runtimebin/go-microvm-runtime-*.tar.gz
+        rm -f "$archive"
 
   fetch-firmware:
     desc: Download pre-built go-microvm firmware from GitHub Release
@@ -150,24 +150,24 @@ tasks:
     cmds:
       - |
         mkdir -p internal/infra/vm/runtimebin
-        gh release download {{.GOMICROVM_VERSION}} --repo stacklok/go-microvm --dir internal/infra/vm/runtimebin/ --clobber --pattern 'go-microvm-firmware-*.tar.gz'
         archive=""
         for os in "{{.HOST_OS}}" "{{.HOST_OS_ALT}}"; do
           for arch in "{{.HOST_ARCH}}" "{{.HOST_ARCH_ALT}}"; do
             candidate="internal/infra/vm/runtimebin/go-microvm-firmware-${os}-${arch}.tar.gz"
-            if [ -f "$candidate" ]; then
+            url="https://github.com/stacklok/go-microvm/releases/download/{{.GOMICROVM_VERSION}}/go-microvm-firmware-${os}-${arch}.tar.gz"
+            if curl --fail --location --retry 3 --output "$candidate" "$url"; then
               archive="$candidate"
               break 2
             fi
+            rm -f "$candidate"
           done
         done
         if [ -z "$archive" ]; then
-          echo "no firmware archive found in internal/infra/vm/runtimebin"
-          ls -1 internal/infra/vm/runtimebin/go-microvm-firmware-*.tar.gz || true
+          echo "no firmware archive available for {{.HOST_OS}}/{{.HOST_ARCH}}"
           exit 1
         fi
         tar -xzf "$archive" -C internal/infra/vm/runtimebin/ --strip-components=1
-        rm -f internal/infra/vm/runtimebin/go-microvm-firmware-*.tar.gz
+        rm -f "$archive"
 
   test:
     desc: Run unit tests
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index 016389f..0b3808f 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -6,7 +6,7 @@
 - [Task](https://taskfile.dev/) (task runner)
 - [golangci-lint](https://golangci-lint.run/)
 - [goimports](https://pkg.go.dev/golang.org/x/tools/cmd/goimports)
-- [GitHub CLI (`gh`)](https://cli.github.com/) (for `task build` to download pre-built runtime artifacts)
+- [curl](https://curl.se/) (for `task build` to download pre-built runtime artifacts)
 
 For running VMs:
 - Linux with KVM support, or macOS with Hypervisor.framework (Apple Silicon)
diff --git a/docs/MACOS.md b/docs/MACOS.md
index 718236d..1a09fc1 100644
--- a/docs/MACOS.md
+++ b/docs/MACOS.md
@@ -30,7 +30,7 @@ The default build embeds the go-microvm runtime into `bbox`:
 task build
 ```
 
-This downloads the pinned runtime artifacts via `gh` and produces a self-contained
+This downloads the pinned runtime artifacts via `curl` and produces a self-contained
 `bin/bbox` (pure Go, no CGO) that does not depend on Homebrew `libkrun`.
 
 Firmware (`libkrunfw`) is not embedded. It is downloaded at runtime and cached