curl -fsSL https://codetruss.com/install.sh | shirm https://codetruss.com/install.ps1 | iexRequires Node.js 20.9.0 or newer, npm, and Git. The installer fetches the release metadata, downloads the versioned package, compares its SHA-256 with the published digest, and refuses to install on a mismatch. Then run codetruss setup once inside a Git repository. Homebrew, npm, and npx installs, plus the full quickstart, are on the CLI page.
Artifacts
Digests come from the release metadata this deploy ships. Tarballs also carry a .sha256 sidecar in the format shasum -c reads.
| Artifact | Version | SHA-256 |
|---|---|---|
| codetruss-cli-0.2.64.tgz The package the installers resolve and npm installs. | 0.2.64 | 3f3b6372291d746a012d90833f2ec434d581b546838616fa0b2f8e16386bb81a.sha256 sidecar |
| codetruss-cli-latest.tgz Moving alias. Today it serves the same bytes as 0.2.64. | latest → 0.2.64 | 3f3b6372291d746a012d90833f2ec434d581b546838616fa0b2f8e16386bb81a.sha256 sidecar |
| codetruss-cli-0.2.64.sbom.cdx.json CycloneDX software bill of materials for that package. | 0.2.64 | 2f3fc7f34eccf7ec8cbd8ab297f012400c5b26f64a0607cee5440f79ea82a3fb |
| codetruss-cli-latest.json Release metadata install.sh reads to resolve the version and its digest. | latest → 0.2.64 | — |
Verify before you run it
curl -fsSLO https://codetruss.com/downloads/codetruss-cli-0.2.64.tgz
curl -fsSLO https://codetruss.com/downloads/codetruss-cli-0.2.64.tgz.sha256
shasum -a 256 -c codetruss-cli-0.2.64.tgz.sha256This proves the bytes you received match the digest CodeTruss publishes. It is tamper-evidence against a corrupted or swapped download; by itself it is not independent package provenance.
gh attestation verify codetruss-cli-0.2.64.tgz --repo CodeTruss/codetruss-cliThe GitHub CLI checks the artifact against the signed provenance recorded by the v0.2.64 release in the CLI repository. That ties these bytes to the workflow that built them.