1.19

• built on Go 1.24.6, github.com/moby/sys/user 0.1.0, golang.org/x/sys(/unix) 0.1.0;
  see SECURITY.md for CVE/security advice

• update for https://pkg.go.dev/vuln/GO-2025-3956 (#163)

  I don't think this is a critical issue with gosu (as it requires a misconfigured environment and we only invoke LookPath after we've dropped from root), but one worth updating for.

full changelog: 1.18...1.19

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

1.18

• built on Go 1.24.0, github.com/moby/sys/user 0.1.0, golang.org/x/sys(/unix) 0.1.0;
  see SECURITY.md for CVE/security advice

• add -trimpath for cleaner binaries (#137)

• remove explicit use of text/template, fmt, log, path/filepath, strings, and io for smaller binaries / package import tree (#138, #139, ccc5c46)

• use https://github.com/tianon/fake-git to embed version numbers in release binaries (#155)

full changelog: 1.17...1.18

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

1.17

• built on Go 1.18.2 (+ golang/go@2c7c98c), github.com/moby/sys/user 0.1.0;
  see SECURITY.md for CVE/security advice
• swap from runc's library to the new github.com/moby/sys/user which is a faithful, history-preserving lift-and-shift of the same code (#134)
• also explicitly block setgid, even though that vector is a lot smaller (#129)

full changelog: 1.16...1.17

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

1.16

• built on Go 1.18.2 (+ golang/go@2c7c98c), runc 1.1.0; see SECURITY.md for CVE/security advice
• fixed mips64le builds (#121)

full changelog: 1.15...1.16

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

1.15

• built on Go 1.18.2, runc 1.1.0, Alpine 3.14
• added SECURITY.md with CVE/security advice (#120)

full changelog: 1.14...1.15

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

Note: the mips64le builds here are affected by golang/go#56426, which isn't actually fixed until Go 1.20+ (not GA as of the time of this release 😩)

1.14

• built on Go 1.16.7, runc 1.0.1, Alpine 3.14
• explicitly disavow/disallow horribly insecure setuid installations (#89)

full changelog: 1.13...1.14

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

1.13

• built on Go 1.16.5, runc 1.0.0-rc95, Alpine 3.13
• added riscv64 support
• re-licensed to Apache-2.0 (#83)

full changelog: 1.12...1.13

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

1.12

• built on Go 1.13.10, runc 1.0.0-rc10, Alpine 3.11
• added mips64le support (#69)
• dropped ppc64 support (not to be confused with ppc64le)

full changelog: 1.11...1.12

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

1.11

• built on Go 1.11.1, runc 1.0.0-rc5, Alpine 3.8
• added explicit --version and --help flags (#44)

full changelog: 1.10...1.11

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

See INSTALL.md for (example) installation instructions.

1.10

• built on Go 1.7 (#25)
• official s390x release binary (#28)
• slightly simpler usage output

full changelog: 1.9...1.10

4096R / B42F 6819 007F 00F8 8E36 4FD4 036A 9C25 BF35 7DD4

$ arch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"
$ wget -O gosu "https://github.com/tianon/gosu/releases/download/1.10/gosu-$arch"
$ chmod +x gosu
$ ./gosu
Usage: gosu user-spec command [args]
   ie: gosu tianon bash
       gosu nobody:root bash -c 'whoami && id'
       gosu 1000:1 id

gosu version: 1.10 (go1.7.1 on linux/amd64; gc)
     license: GPL-3 (full text at https://github.com/tianon/gosu)