diff --git a/ci/release/_install.sh b/ci/release/_install.sh
index a66f2d730..49f936ffc 100755
--- a/ci/release/_install.sh
+++ b/ci/release/_install.sh
@@ -450,13 +450,10 @@ uninstall_tala_brew() {
 }
 
 is_prefix_writable() {
-  sh_c "mkdir -p '$INSTALL_DIR' 2>/dev/null" || true
   # The reason for checking whether $INSTALL_DIR is writable is that on macOS you have
   # /usr/local owned by root but you don't need root to write to its subdirectories which
   # is all we want to do.
-  if [ ! -w "$INSTALL_DIR" ]; then
-    return 1
-  fi
+  is_writable_dir "$INSTALL_DIR"
 }
 
 cache_dir() {
diff --git a/ci/release/gen_template_lib.sh b/ci/release/gen_template_lib.sh
index 1f523767a..27e63ac9e 100755
--- a/ci/release/gen_template_lib.sh
+++ b/ci/release/gen_template_lib.sh
@@ -14,6 +14,7 @@ sh_c cat >./ci/release/template/scripts/lib.sh <<EOF
 #
 # - ./ci/sub/lib/rand.sh
 # - ./ci/sub/lib/log.sh
+# - ./ci/sub/lib/release.sh
 #
 # Generated by ./ci/release/gen_template_lib.sh.
 # *************
@@ -25,5 +26,6 @@ EOF
 sh_c cat \
   ./ci/sub/lib/rand.sh \
   ./ci/sub/lib/log.sh \
+  ./ci/sub/lib/release.sh \
   \| sed "-e'/^\. /d'" \>\>./ci/release/template/scripts/lib.sh
 sh_c chmod -w ./ci/release/template/scripts/lib.sh
diff --git a/ci/release/template/Makefile b/ci/release/template/Makefile
index 5b9ba1353..44f22ddb0 100644
--- a/ci/release/template/Makefile
+++ b/ci/release/template/Makefile
@@ -1,6 +1,11 @@
 .POSIX:
 .SILENT:
 
+.PHONY: all
+all:
+	(. ./scripts/lib.sh && echoerr "You must provide a target of install or uninstall for this Makefile")
+	exit 1
+
 PREFIX = $(DESTDIR)/usr/local
 
 .PHONY: install
diff --git a/ci/release/template/scripts/install.sh b/ci/release/template/scripts/install.sh
index 043e5d098..4127f25a8 100755
--- a/ci/release/template/scripts/install.sh
+++ b/ci/release/template/scripts/install.sh
@@ -9,10 +9,15 @@ main() {
     return 1
   fi
 
-  sh_c mkdir -p "$PREFIX/bin"
-  sh_c install ./bin/d2 "$PREFIX/bin/d2"
-  sh_c mkdir -p "$PREFIX/share/man/man1"
-  sh_c install ./man/d2.1 "$PREFIX/share/man/man1"
+  sh_c="sh_c"
+  if ! is_writable_dir "$PREFIX/bin"; then
+    sh_c="sudo_sh_c"
+  fi
+
+  "$sh_c" mkdir -p "$PREFIX/bin"
+  "$sh_c" install ./bin/d2 "$PREFIX/bin/d2"
+  "$sh_c" mkdir -p "$PREFIX/share/man/man1"
+  "$sh_c" install ./man/d2.1 "$PREFIX/share/man/man1"
 }
 
 main "$@"
diff --git a/ci/release/template/scripts/lib.sh b/ci/release/template/scripts/lib.sh
index 0bdd40454..cf17657e7 100644
--- a/ci/release/template/scripts/lib.sh
+++ b/ci/release/template/scripts/lib.sh
@@ -7,6 +7,7 @@
 #
 # - ./ci/sub/lib/rand.sh
 # - ./ci/sub/lib/log.sh
+# - ./ci/sub/lib/release.sh
 #
 # Generated by ./ci/release/gen_template_lib.sh.
 # *************
@@ -298,3 +299,56 @@ capcode() {
   code=$?
   set -e
 }
+#!/bin/sh
+if [ "${LIB_RELEASE-}" ]; then
+  return 0
+fi
+LIB_RELEASE=1
+
+goos() {
+  case $1 in
+    macos) echo darwin ;;
+    *) echo $1 ;;
+  esac
+}
+
+os() {
+  uname=$(uname)
+  case $uname in
+    Linux) echo linux ;;
+    Darwin) echo macos ;;
+    FreeBSD) echo freebsd ;;
+    *) echo "$uname" ;;
+  esac
+}
+
+arch() {
+  uname_m=$(uname -m)
+  case $uname_m in
+    aarch64) echo arm64 ;;
+    x86_64) echo amd64 ;;
+    *) echo "$uname_m" ;;
+  esac
+}
+
+gh_repo() {
+  gh repo view --json nameWithOwner --template '{{ .nameWithOwner }}'
+}
+
+manpath() {
+  if command -v manpath >/dev/null; then
+    command manpath
+  elif man -w 2>/dev/null; then
+    man -w
+  else
+    echo "${MANPATH-}"
+  fi
+}
+
+is_writable_dir() {
+  # The path has to exist for -w to succeed.
+  sh_c "mkdir -p '$1' 2>/dev/null" || true
+  if [ ! -w "$1" ]; then
+    return 1
+  fi
+}
diff --git a/ci/release/template/scripts/uninstall.sh b/ci/release/template/scripts/uninstall.sh
index e21877ca9..56336e8d1 100755
--- a/ci/release/template/scripts/uninstall.sh
+++ b/ci/release/template/scripts/uninstall.sh
@@ -9,8 +9,13 @@ main() {
     return 1
   fi
 
-  sh_c rm -f "$PREFIX/bin/d2"
-  sh_c rm -f "$PREFIX/share/man/man1/d2.1"
+  sh_c="sh_c"
+  if ! is_writable_dir "$PREFIX/bin"; then
+    sh_c="sudo_sh_c"
+  fi
+
+  "$sh_c" rm -f "$PREFIX/bin/d2"
+  "$sh_c" rm -f "$PREFIX/share/man/man1/d2.1"
 }
 
 main "$@"
diff --git a/ci/sub b/ci/sub
index ea5566075..70a9ad95e 160000
--- a/ci/sub
+++ b/ci/sub
@@ -1 +1 @@
-Subproject commit ea5566075122e826293ef3cf98c5fffcbee99341
+Subproject commit 70a9ad95ea0ae1de83fa3b7f7d4a160db4853c20
diff --git a/install.sh b/install.sh
index 74d2ff8e3..a951260b4 100755
--- a/install.sh
+++ b/install.sh
@@ -480,6 +480,14 @@ manpath() {
     echo "${MANPATH-}"
   fi
 }
+
+is_writable_dir() {
+  # The path has to exist for -w to succeed.
+  sh_c "mkdir -p '$1' 2>/dev/null" || true
+  if [ ! -w "$1" ]; then
+    return 1
+  fi
+}
 #!/bin/sh
 set -eu
 
@@ -927,13 +935,10 @@ uninstall_tala_brew() {
 }
 
 is_prefix_writable() {
-  sh_c "mkdir -p '$INSTALL_DIR' 2>/dev/null" || true
   # The reason for checking whether $INSTALL_DIR is writable is that on macOS you have
   # /usr/local owned by root but you don't need root to write to its subdirectories which
   # is all we want to do.
-  if [ ! -w "$INSTALL_DIR" ]; then
-    return 1
-  fi
+  is_writable_dir "$INSTALL_DIR"
 }
 
 cache_dir() {