Symptoms
The bot self-updates yt-dlp every 5 minutes to the latest nightly release. A freshly published release can be installed within minutes of publication. If the upstream release pipeline were ever compromised, the bot would pull a malicious binary before the ecosystem has a chance to notice and yank it.
Requirements
- Do not install a yt-dlp release younger than a configurable minimum age (X minutes). Releases below the age floor are skipped; the bot keeps its current binary until the release matures.
- Freshness still matters (the nightly channel exists so extractors track site changes), so the floor should be a deliberate trade-off between extractor freshness and yank window, not maximally conservative.
Symptoms
The bot self-updates yt-dlp every 5 minutes to the latest nightly release. A freshly published release can be installed within minutes of publication. If the upstream release pipeline were ever compromised, the bot would pull a malicious binary before the ecosystem has a chance to notice and yank it.
Requirements