bw 2026.9.0 as y-bw, Bitwarden's GPL CLI build

For Vaultwarden at opsv.yolean.se (checkit vault-v1). The bw-oss assets
are the GPLv3 build; Bitwarden's other builds are under its commercial
licence from the release after 2026.9. 2026.9.0, not 2026.9.1, which is
under two weeks old.

The assets mark only arm64 (bw-oss-linux-2026.9.0.zip,
bw-oss-linux-arm64-2026.9.0.zip), so y-bin-download gets ${_arm64},
"-arm64" on arm64 and empty otherwise, and y-bin-download-next sets it
per platform. y-bin-download-next recomputed all four checksums from the
template and they equal Bitwarden's published digests.

Checks: y-bw --version prints 2026.9.0 on linux/amd64 (with a test-only
unzip stand-in, this host has no unzip); y-script-lint --fail=degrade
bin/ reports no degradation, y-bw clean; yconverge/itest/test.sh passed
against y-cluster's dockerhost (an uncommitted copy addressing the kwok
port on the guest, and kubectl from the main checkout). Not run:
e2e-cluster, which needs local docker and host ports.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Yolean gle-qa

bin/.gitignore

@@ -65,3 +65,4 @@ duckdb
 uv
 stern
 watchexec
+bw

bin/y-bin-download

@@ -82,6 +82,15 @@ osmac_() {
   esac
 }
 
+# "-arm64" on arm64 and nothing on amd64, for names that mark only the non-default arch
+_arm64() {
+  x=$(arch)
+  case $x in
+    arm64) echo '-arm64' ;;
+    *) echo '' ;;
+  esac
+}
+
 # vendor-os part of rust style target triples, i.e. ${aarch}-${ostriple}
 ostriple() {
   os=$(os)
@@ -178,6 +187,7 @@ run() {
   Os=$(Os)
   arm=$(arm)
   xarm=$(xarm)
+  _arm64=$(_arm64)
   eval $(to_eval $yaml $name)
   install "$name" "$version" "$url" "$sha256" "$archivetool" "$archivepath"
 }

bin/y-bin-download-next

@@ -49,6 +49,7 @@ ostriple=apple-darwin
 Os=Darwin
 arm=""
 xarm=x
+_arm64=""
 echo -n "    darwin_amd64: " && checksum
 
 os=darwin
@@ -63,6 +64,7 @@ ostriple=apple-darwin
 Os=Darwin
 arm=arm
 xarm=arm
+_arm64="-arm64"
 echo -n "    darwin_arm64: " && checksum
 
 os=linux
@@ -77,6 +79,7 @@ ostriple=unknown-linux-gnu
 Os=Linux
 arm=""
 xarm=x
+_arm64=""
 echo -n "    linux_amd64: " && checksum
 
 os=linux
@@ -91,4 +94,5 @@ ostriple=unknown-linux-gnu
 Os=Linux
 arm=arm
 xarm=arm
+_arm64="-arm64"
 echo -n "    linux_arm64: " && checksum

bin/y-bin.optional.yaml

@@ -302,3 +302,18 @@ duckdb:
   archive:
     tool: zip
     path: duckdb
+
+# Bitwarden's CLI, for Vaultwarden at opsv.yolean.se. The bw-oss build is GPLv3; Bitwarden's
+# other builds are under its commercial licence from the release after 2026.9.
+bw:
+  version: 2026.9.0
+  templates:
+    download: https://github.com/bitwarden/clients/releases/download/cli-v${version}/bw-oss-${osmac}${_arm64}-${version}.zip
+  sha256:
+    darwin_amd64: 6d6ab08255d08c7492c288ec1d6a314fea52d9660ffb1cb7741db8cad548cb65
+    darwin_arm64: fc378d79fefb36128d2b401d19649a88d036646eba6b21b2c305fe53528d2e96
+    linux_amd64: b34fcaa0a8c96df0783e09ed6c9c22003497e5b429351c42127206b794c6b69b
+    linux_arm64: b2da40ee84aa8794f9f7567e8fc71d5a0c02c6b2355c60c71c9df6334c5d33b8
+  archive:
+    tool: zip
+    path: bw

bin/y-bw

@@ -0,0 +1,8 @@
+#!/bin/sh
+[ -z "$DEBUG" ] || set -x
+set -e
+YBIN="$(dirname $0)"
+
+version=$(y-bin-download $YBIN/y-bin.optional.yaml bw)
+
+y-bw-v${version}-bin "$@" || exit $?