Upgrade kingpin for fish shell completions

[mbyczkowski]

Why

certigo uses kingpin to parse its command line. Kingpin can also print shell completion scripts through hidden flags such as --completion-script-bash. The Homebrew formula uses these flags to install bash and zsh completions.

Kingpin v2.4.0, the version certigo uses today, has no fish support. #365 fills the gap with a hand-written fish script. Kingpin added fish support upstream in March 2026, in alecthomas/kingpin#363 and the fixup alecthomas/kingpin#364. The upgrade gets us fish completions with no script to maintain.

What

• Upgrade github.com/alecthomas/kingpin/v2 from v2.4.0 to v2.4.1-0.20260925234028-f5476eeb56de, the newest commit on kingpin master.
• certigo --completion-script-fish now prints a fish completion script.

How

Kingpin has not tagged a release since v2.4.0 in September 2023, so this pins a pseudo-version (Go's name for an untagged commit). go.sum records its hash, so builds stay reproducible.

The fish script is one rule. It passes the words typed so far to certigo --completion-bash, the same hook the bash script uses, so it stays in step with the CLI. When certigo has no suggestion, as for a file argument, fish falls back to file paths.

I pinned the newest commit instead of the fixup (f0601543). The five commits after the fixup are a dependency bump, a CI update, typo fixes, a linker change, and a fix that keeps the value of a bare - argument.

Risk

Low. Only go.mod and go.sum change, and no other module moves. Help text and bash/zsh completion output are the same as before.

One error message changes. certigo dump - now says path '-' does not exist instead of path '' does not exist. The command failed before too, and certigo reads stdin only when dump gets no file.

Untagged code has had less use than a release. Also, the fish script uses commandline -x, which fish added in 4.0 (February 2025), so it will not work on fish 3.x.

Testing

I built master and this branch with Go 1.27.1 and CGO_ENABLED=0, then compared their output:

• --help, --version, and --help for connect, dump and verify print the same text.
• --completion-script-bash and --completion-script-zsh print the same scripts.
• --completion-bash returns the same candidates for commands, flags and the --start-tls values.
• --completion-script-fish fails on master with unknown long flag '--completion-script-fish'. This branch prints:

complete -c certigo -f -a '(
    set -l tokens (commandline -xpc)
    set -l current (commandline -ct)
    set -l completions (certigo --completion-bash $tokens[2..] $current)
    if test -n "$completions"
        printf "%s\n" $completions
    else
        __fish_complete_path $current
    end
)'

I have not run the script in a live fish shell.

Bigger picture

• This replaces Fish shell compeltion #365.
• After the next release, the Homebrew formula can add :fish to the shells it passes to generate_completions_from_executable. Today it installs only bash and zsh completions.
• When kingpin tags a release with these commits, switch to the tag.

Generated with Claude Code