This repository is the canonical source for the scripts used to install the Cloudsmith CLI standalone binary:

• install.sh for Linux and macOS using POSIX sh
• install.ps1 for Windows using PowerShell

The scripts detect the host platform, download the matching release archive, verify its SHA-256 checksum, and install the CLI into a versioned directory. They do not modify PATH or authenticate with Cloudsmith.

Download the appropriate script from a tagged GitHub release and verify it against the release's SHA256SUMS file before running it.

sh ./install.sh --version latest

./install.ps1 -Version latest

On success, use the reported bin_dir to update PATH, or invoke the reported executable directly.

Tagged releases are also published to Cloudsmith as cli.sh and cli.ps1, served at stable short URLs. Install the latest CLI with one command:

curl -fsSL https://install.cloudsmith.com/raw/files/cli.sh | sh

irm https://install.cloudsmith.com/raw/files/cli.ps1 | iex

Both scripts install the latest CLI version by default and print the installed bin_dir to add to PATH.

To verify before running, or to pin a version, download the script and SHA256SUMS from https://dl.cloudsmith.io/public/cloudsmith/cloudsmith-cli-install-script/raw/names/<name>/versions/<version|latest>/<name> where <name> is cli.sh, cli.ps1, or SHA256SUMS, then run it with --version X.Y.Z (-Version X.Y.Z in PowerShell). Use pinned, verified downloads in CI.

flowchart LR
    A[Detect host] --> B[Resolve CLI release]
    B --> C[Download archive]
    C --> D[Verify SHA-256]
    D --> E[Validate contents]
    E --> F[Install atomically]

An existing verified installation is reused unless a forced reinstall is requested. Concurrent installations are serialized with a lock.

After resolving the release manifest, the shell installer checks the required archive and checksum tools before downloading the release archive.

Command-line options take precedence over environment variables.

Run sh ./install.sh --help for shell usage. PowerShell parameters support standard Get-Help and tab completion.

Each installer emits exactly four key=value lines to standard output, or to the requested output file. Diagnostic messages are written to standard error.

version=1.19.0
target=linux-x86_64-gnu
bin_dir=/home/runner/.local/share/cloudsmith-cli/1.19.0/linux-x86_64-gnu/cloudsmith
executable=/home/runner/.local/share/cloudsmith-cli/1.19.0/linux-x86_64-gnu/cloudsmith/cloudsmith

The installers apply the following safeguards:

• HTTPS-only downloads
• SHA-256 verification before extraction
• archive validation to reject absolute paths and parent-directory traversal
• executable validation with cloudsmith --version before activation
• atomic activation and serialized concurrent installs
• reuse only after validating an existing installation

The shell installer uses curl or wget; the PowerShell installer uses the .NET web request stack. Standard proxy configuration and operating-system certificate trust stores apply. All installer download requests send a cloudsmith-cli-install-script user agent that includes the operating system and architecture.

To report a potential vulnerability, follow the security policy instead of opening a public issue.

Tagged releases publish install.sh, install.ps1, and SHA256SUMS. The approved installer bytes are also vendored into:

See CONTRIBUTING.md for the development workflow and tests/README.md for test-suite requirements.

Releases use vX.Y.Z tags, and published release assets are immutable. Breaking changes to command-line options, environment variables, installation layout, supported targets, or the output contract require a major version bump.

See SUPPORT.md for the information to include when requesting help.

Licensed under the Apache License 2.0.