fix(install): retry GitHub downloads with exponential backoff

The installer served at https://get.livekit.io/cli makes three unguarded
curl calls to GitHub (the releases API, the archive, and checksums.txt).
Any transient failure aborts the whole install, which makes CI runners
flaky.

Route all three through a `fetch` helper that retries connection errors,
timeouts, 5xx, 408, 429, and the 403 GitHub returns when rate limiting,
with exponential backoff (5 attempts, 2s doubling). Permanent 4xx
responses still fail immediately. Attempt count and base delay are
overridable via LK_INSTALL_MAX_ATTEMPTS / LK_INSTALL_RETRY_DELAY.

Also adds the missing `jq` prerequisite check — the script already
depended on jq but only reported it as an unhelpful version parse error.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: stephen-derosa

install-cli.sh

@@ -31,10 +31,60 @@ FISH_COMPLETION_PATH="/usr/share/fish/vendor_completions.d"
 log()   { printf "%b\n" "$*"; }
 abort() { printf "%s\n" "$@" >&2; exit 1; }
 
+# GitHub is frequently flaky from CI runners, so every download is retried with
+# exponential backoff. Overridable for testing / impatient callers.
+MAX_ATTEMPTS="${LK_INSTALL_MAX_ATTEMPTS:-5}"
+RETRY_DELAY="${LK_INSTALL_RETRY_DELAY:-2}"
+
+# fetch <url> <output-file>
+#
+# Downloads a URL, retrying transient failures (connection errors, timeouts,
+# 5xx, 408, 429, and the 403 GitHub returns when rate limiting) with
+# exponential backoff. Permanent 4xx responses fail immediately, since no
+# amount of retrying will turn a 404 into a release archive.
+fetch() {
+  local url="$1" out="$2"
+  local attempt=1 delay="$RETRY_DELAY" status rc reason
+
+  while :; do
+    rc=0
+    status=$(curl -sSL \
+      --connect-timeout 10 \
+      --max-time 300 \
+      --output "$out" \
+      --write-out '%{http_code}' \
+      "$url") || rc=$?
+
+    if [ "$rc" -eq 0 ] && [ "$status" -ge 200 ] && [ "$status" -lt 300 ]; then
+      return 0
+    fi
+
+    if [ "$rc" -eq 0 ]; then
+      reason="HTTP $status"
+      case "$status" in
+        408|429|403) ;;
+        4??) abort "Failed to download $url ($reason)" ;;
+      esac
+    else
+      reason="curl exit $rc"
+    fi
+
+    if [ "$attempt" -ge "$MAX_ATTEMPTS" ]; then
+      abort "Failed to download $url after $MAX_ATTEMPTS attempts ($reason)"
+    fi
+
+    log "Download of $url failed ($reason), retrying in ${delay}s (attempt $((attempt + 1))/$MAX_ATTEMPTS)..."
+    sleep "$delay"
+    attempt=$((attempt + 1))
+    delay=$((delay * 2))
+  done
+}
+
 [ -n "${BASH_VERSION:-}" ] || abort "This script requires bash"
 [ -d "$INSTALL_PATH" ]     || abort "Could not install, $INSTALL_PATH doesn't exist"
 command -v curl >/dev/null || abort "cURL is required and is not found"
 command -v sha256sum >/dev/null || abort "sha256sum is required and is not found"
+command -v jq >/dev/null || abort "jq is required and is not found"
 
 OS="$(uname)"
 case "$OS" in
@@ -55,8 +105,11 @@ if [ ! -w "$INSTALL_PATH" ]; then
   log "sudo is required to install to $INSTALL_PATH"
 fi
 
-VERSION=$(curl -fsSL https://api.github.com/repos/livekit/$REPO/releases/latest \
-  | jq -r '.tag_name' | sed 's/^v//')
+TEMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+fetch "https://api.github.com/repos/livekit/$REPO/releases/latest" "$TEMP_DIR/latest.json"
+VERSION=$(jq -r '.tag_name' "$TEMP_DIR/latest.json" | sed 's/^v//')
 
 [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || abort "Invalid version: $VERSION"
 
@@ -67,11 +120,8 @@ CHECKSUMS_URL="https://github.com/livekit/$REPO/releases/download/v${VERSION}/ch
 log "Installing $REPO $VERSION"
 log "Downloading from $ARCHIVE_URL..."
 
-TEMP_DIR=$(mktemp -d)
-trap 'rm -rf "$TEMP_DIR"' EXIT
-
-curl -fsSL "$ARCHIVE_URL" -o "$TEMP_DIR/$ARCHIVE_NAME"
-curl -fsSL "$CHECKSUMS_URL" -o "$TEMP_DIR/checksums.txt"
+fetch "$ARCHIVE_URL" "$TEMP_DIR/$ARCHIVE_NAME"
+fetch "$CHECKSUMS_URL" "$TEMP_DIR/checksums.txt"
 
 # Verify the archive against the release's checksums.txt before extracting. The checksums
 # file is fetched from the same release over HTTPS, so this guards against corrupted/partial