Skip to content

Latest commit

 

History

History
107 lines (79 loc) · 2.6 KB

INSTALL.md

File metadata and controls

107 lines (79 loc) · 2.6 KB

Install

cmdx is written in Go. So you only have to install a binary in your PATH.

There are some ways to install cmdx.

  1. Homebrew
  2. aqua
  3. GitHub Releases
  4. Build an executable binary from source code yourself using Go

Homebrew

You can install cmdx using Homebrew.

brew install suzuki-shunsuke/cmdx/cmdx

aqua

You can install cmdx using aqua.

aqua g -i suzuki-shunsuke/cmdx

Build an executable binary from source code yourself using Go

go install github.com/suzuki-shunsuke/cmdx/cmd/cmdx@latest

GitHub Releases

You can download an asset from GitHub Releases. Please unarchive it and install a pre built binary into $PATH.

Verify downloaded assets from GitHub Releases

You can verify downloaded assets using some tools.

  1. GitHub CLI
  2. slsa-verifier
  3. Cosign

1. GitHub CLI

You can install GitHub CLI by aqua.

aqua g -i cli/cli
version=v1.7.5
asset=cmdx_darwin_arm64.tar.gz
gh release download -R suzuki-shunsuke/cmdx "$version" -p "$asset"
gh attestation verify "$asset" \
  -R suzuki-shunsuke/cmdx \
  --signer-workflow suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml

2. slsa-verifier

You can install slsa-verifier by aqua.

aqua g -i slsa-framework/slsa-verifier
version=v1.7.5
asset=cmdx_darwin_arm64.tar.gz
gh release download -R suzuki-shunsuke/cmdx "$version" -p "$asset" -p multiple.intoto.jsonl
slsa-verifier verify-artifact "$asset" \
  --provenance-path multiple.intoto.jsonl \
  --source-uri github.com/suzuki-shunsuke/cmdx \
  --source-tag "$version"

3. Cosign

You can install Cosign by aqua.

aqua g -i sigstore/cosign
version=v1.7.5
checksum_file="cmdx_${version#v}_checksums.txt"
asset=cmdx_darwin_arm64.tar.gz
gh release download "$version" \
  -R suzuki-shunsuke/cmdx \
  -p "$asset" \
  -p "$checksum_file" \
  -p "${checksum_file}.pem" \
  -p "${checksum_file}.sig"
cosign verify-blob \
  --signature "${checksum_file}.sig" \
  --certificate "${checksum_file}.pem" \
  --certificate-identity-regexp 'https://github\.com/suzuki-shunsuke/go-release-workflow/\.github/workflows/release\.yaml@.*' \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  "$checksum_file"
cat "$checksum_file" | sha256sum -c --ignore-missing