Installation
Verified One-shot Installer
Section titled “Verified One-shot Installer”The installers verify the exact checksum row and Sigstore bundle with cosign, validate the bounded SAFE-ARCHIVE-V1 tree, atomically replace the binary, and roll back if the installed binary cannot report its version.
# macOS or Linux; cosign must already be on PATHcurl -fsSL https://skret.n24q02m.com/install.sh | sh# Windows; cosign must already be on PATHiwr -useb https://skret.n24q02m.com/install.ps1 | iexSKRET_INSECURE_SKIP_VERIFY=1 is an explicit signature-verification bypass. It does not bypass checksums, archive/path validation, atomic replacement, or the version smoke.
Package Managers
Section titled “Package Managers”macOS and Linux — Homebrew
Section titled “macOS and Linux — Homebrew”brew install n24q02m/tap/skretWindows — Scoop
Section titled “Windows — Scoop”scoop bucket add n24q02m https://github.com/n24q02m/scoop-bucketscoop install skretAfter a package-manager install, compare skret --version with the current stable GitHub Release. A stale channel is not equivalent to the selected release.
Go Install
Section titled “Go Install”Requires Go 1.26 or newer:
go install github.com/n24q02m/skret/cmd/skret@latestOCI Image Status
Section titled “OCI Image Status”Skret does not currently advertise a mutable GHCR tag as an installation channel. In particular, do not depend on ghcr.io/n24q02m/skret:latest. OCI consumption resumes only after the protected publisher emits an immutable digest plus matching source, checksum, SBOM, signature, and provenance metadata.
Binary Download
Section titled “Binary Download”Download pre-built binaries from GitHub Releases:
| Platform | Architecture | File |
|---|---|---|
| Linux | amd64 | skret_VERSION_linux_amd64.tar.gz |
| Linux | arm64 | skret_VERSION_linux_arm64.tar.gz |
| macOS | amd64 | skret_VERSION_darwin_amd64.tar.gz |
| macOS | arm64 (Apple Silicon) | skret_VERSION_darwin_arm64.tar.gz |
| Windows | amd64 | skret_VERSION_windows_amd64.zip |
| Windows | arm64 | skret_VERSION_windows_arm64.zip |
Verify checksums.txt.bundle with cosign, then verify the downloaded archive against checksums.txt before extraction. See the release verification procedure.
Verify Installation
Section titled “Verify Installation”skret --versionThe reported version, commit, and build timestamp must match the selected release evidence. Do not use a hardcoded example as artifact identity proof.