Install

Linux / macOS

curl -fsSL https://hort.rs/install-cli.sh | sh

Windows (PowerShell)

irm https://hort.rs/install-cli.ps1 | iex

Fail-closed by design

It is fail-closed: before anything is written to your system it

1. verifies the download's SHA-256 against the published checksum, and
2. verifies the download's keyless cosign signature against the Hort release identity (cosign verify-blob).

If either check fails, nothing is installed. If cosign isn't already on your PATH, the installer bootstraps a version-pinned copy (cosign ≥ v3.0) and verifies its checksum before using it. There is intentionally no option to skip verification.

To verify a download yourself instead, see release-verification.md.

Manual download & verify

Prefer to fetch and verify a binary yourself? Every release is archived permanently at /dl/, keyed by tag. Pick your platform's archive (e.g. hort-cli-linux-amd64.tar.gz) plus its .sha256 and .bundle sidecars, then:

# checksum
sha256sum -c hort-cli-<platform>.tar.gz.sha256

# keyless cosign signature (same identity the installer itself checks)
cosign verify-blob \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp='https://github.com/project-hort/.*' \
  --bundle hort-cli-<platform>.tar.gz.bundle \
  hort-cli-<platform>.tar.gz

Nothing here differs from the one-liner above -- it runs the identical checks. dl/ exists for pinning an exact historical version, air-gapped installs, and auditing.