Install InstallGuard

macOS / Linux (Homebrew)

macOS · Linux

Copy terminal contents

$ brew install jt-systems/installguard/installguard

The tap installs a single static binary; no Ruby, Python, or Node runtime is required.

From source (any platform with Rust ≥ 1.86)

Any platform · cargo install

Copy terminal contents

$ cargo install --git https://github.com/jt-systems/installguard installguard --locked

Pre-built binaries

Every release publishes static binaries for:

• aarch64-apple-darwin
• x86_64-apple-darwin
• aarch64-unknown-linux-musl
• x86_64-unknown-linux-musl
• x86_64-pc-windows-msvc

Download the latest from GitHub Releases, drop into your $PATH. Each binary, plus checksums.txt, ships with a Sigstore (cosign keyless) bundle for cryptographic verification — see below.

Verify a downloaded binary

Every release artefact is signed by the release workflow using cosign keyless signing. The signing identity is bound to the workflow file, the source SHA, and the tag — there are no long-lived keys for an attacker to steal.

You’ll need cosign ≥ 2.0:

macOS · Linux · install cosign

Copy terminal contents

$ brew install cosign

Then, from the directory where you downloaded the binary plus its .cosign.bundle sidecar:

~/Downloads · verify release

Copy terminal contents

$ cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/jt-systems/installguard/\.github/workflows/release\.yml@refs/tags/v.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --bundle installguard-aarch64-apple-darwin.cosign.bundle \
  installguard-aarch64-apple-darwin

A successful verification prints Verified OK and exits 0. Both flags are mandatory — without them an attacker who can mint any Fulcio cert could forge a signature.

For stricter pinning to a specific release, swap v.* for the exact tag (for example v0.3.3) in the identity regex.

The same command verifies checksums.txt against checksums.txt.cosign.bundle if you’d rather verify one signature and trust the SHA-256 chain to the binaries.

SLSA Build Level 3 provenance

In addition to the cosign signatures, every release ships a SLSA v1.0 provenance attestation (installguard-<tag>.intoto.jsonl) generated by the slsa-github-generator reusable workflow on a hardened GitHub-hosted builder. The attestation records exactly which workflow run, source SHA, and builder produced each binary’s bytes, and is signed via the same Fulcio/Rekor path.

Verify with slsa-verifier:

~/Downloads · verify provenance

Copy terminal contents

$ slsa-verifier verify-artifact \
  --provenance-path installguard-<tag>.intoto.jsonl \
  --source-uri github.com/jt-systems/installguard \
  --source-tag <tag> \
  installguard-<target>

Replace <tag> with the release you downloaded (for example v0.3.3) and <target> with the binary filename you verified above (for example aarch64-apple-darwin).

Sanity-check the install

~/work/bin · version check

Copy terminal contents

$ installguard --version
installguard <version>

Expected output is the version number. If you get “command not found”, make sure $(brew --prefix)/bin (or wherever your binary lives) is on $PATH.

Update

InstallGuard is alpha (0.x) and ships fixes regularly — keep up with the latest tag.

Homebrew:

macOS · Linux · Homebrew update

Copy terminal contents

$ brew update && brew upgrade installguard

Cargo (from source): re-run the same install command; cargo install overwrites the existing binary in place.

Any platform · cargo update

Copy terminal contents

$ cargo install --git https://github.com/jt-systems/installguard installguard --locked --force

Pre-built binary: download the new release from GitHub Releases, verify it, and replace the binary on your $PATH.

After upgrading, re-run installguard --version to confirm. If you commit installguard.lock to your repo, the next run on a newer binary may rebuild the lock when the schema version bumps — that’s expected, review the diff and commit it.