How to Install Cynative on macOS, Linux, and Windows

Install the Cynative CLI via Homebrew, install script, Scoop, or manual download. Verify release signatures with Sigstore and Cosign for integrity.

Cynative ships as a single static binary with no runtime dependencies — no Node, no Python, no Docker. Drop it on your PATH and it’s ready to run. Prebuilt binaries are published for macOS (Apple Silicon and Intel), Linux (x86_64 and arm64), and Windows (x86_64 and arm64).

macOS / Linux

Homebrew (recommended)

Homebrew handles installation, updates, and uninstallation and verifies the download automatically:

brew install cynative/tap/cynative

Install script

The install script downloads the latest release archive and checksums.txt from GitHub, verifies the SHA-256 checksum before extracting, and installs the binary to ~/.local/bin by default (no sudo required):

curl -fsSL https://raw.githubusercontent.com/cynative/cynative/main/install.sh | sh

The install script verifies the downloaded archive’s SHA-256 against the release checksums.txt before extracting — it fails closed if the checksum doesn’t match. If the gh CLI is installed, it also checks the GitHub release attestation (advisory by default; set CYNATIVE_REQUIRE_ATTESTATION=1 to make a failed check fatal).

Install script options:

Variable	Default	Effect
CYNATIVE_VERSION	latest	Pin to a specific release tag (e.g. v1.0.0)
CYNATIVE_INSTALL_DIR	~/.local/bin	Change the target installation directory
CYNATIVE_REQUIRE_ATTESTATION	unset	Set to 1 to make a failed release attestation check fatal

For a high-integrity install, fetch the script from an immutable tag instead of main:

curl -fsSL https://raw.githubusercontent.com/cynative/cynative/<tag-or-sha>/install.sh | sh

Uninstall via install script:

curl -fsSL https://raw.githubusercontent.com/cynative/cynative/main/install.sh | sh -s -- --uninstall

Windows

Scoop (recommended)

scoop bucket add cynative https://github.com/cynative/scoop-bucket
scoop install cynative

PowerShell install script

Downloads the latest release .zip, verifies the SHA-256 checksum, extracts the binary, installs it to %LOCALAPPDATA%\cynative\bin, and adds that directory to your user PATH:

irm https://raw.githubusercontent.com/cynative/cynative/main/install.ps1 | iex

Like the shell script, the PowerShell installer verifies the archive’s SHA-256 against checksums.txt before extraction and fails closed on a mismatch. If the gh CLI is installed, it also checks the GitHub release attestation. Set $env:CYNATIVE_REQUIRE_ATTESTATION = '1' to make a failed attestation check fatal.

Uninstall via PowerShell script:

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/cynative/cynative/main/install.ps1))) -Uninstall

PowerShell script options (set as environment variables before running):

Variable	Default	Effect
CYNATIVE_VERSION	latest	Pin to a specific release tag
CYNATIVE_INSTALL_DIR	%LOCALAPPDATA%\cynative\bin	Change the installation directory
CYNATIVE_REQUIRE_ATTESTATION	unset	Set to 1 to make a failed attestation check fatal

Manual Download

Download a prebuilt binary and checksums.txt from the releases page, verify the SHA-256, and put the binary on your PATH.

Linux:

grep cynative_Linux_x86_64.tar.gz checksums.txt | sha256sum -c -

macOS:

grep cynative_Darwin_arm64.tar.gz checksums.txt | shasum -a 256 -c -

Windows (PowerShell):

(Get-FileHash .\cynative_Windows_x86_64.zip -Algorithm SHA256).Hash.ToLower()
Select-String -Path checksums.txt -Pattern cynative_Windows_x86_64.zip

Compare the hash output against the corresponding line in checksums.txt — they must match exactly.

Verify Release Signatures

New releases ship a checksums.txt.sigstore.json file: a Sigstore bundle signing checksums.txt with a keyless certificate bound to this repository’s release workflow. Verifying it confirms that checksums.txt was produced by the official Cynative release pipeline and has not been tampered with — then you check your downloaded archive against that verified manifest.

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/cynative/cynative/.github/workflows/release.yaml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

grep cynative_Linux_x86_64.tar.gz checksums.txt | sha256sum -c -      # Linux
grep cynative_Darwin_arm64.tar.gz checksums.txt | shasum -a 256 -c -  # macOS

Two limits worth knowing:

• cosign fetches Sigstore’s trust root over the network unless you pass --trusted-root.
• Because the file names carry no version, the signature proves origin and integrity but not which release a loose set of files came from — the release URL or gh release verify is what binds a specific version.

The .pkg macOS installers are Developer ID signed, notarized, and stapled instead (see macOS notes below), and every release asset is additionally covered by the GitHub release attestation (gh release verify <tag>).

Updating and Uninstalling

Method	Update	Uninstall
Homebrew	brew upgrade cynative	brew uninstall cynative
Install script	Re-run the one-liner	curl -fsSL https://raw.githubusercontent.com/cynative/cynative/main/install.sh | sh -s -- --uninstall
Scoop	scoop update cynative	scoop uninstall cynative
PowerShell script	Re-run the one-liner	& ([scriptblock]::Create((irm https://raw.githubusercontent.com/cynative/cynative/main/install.ps1))) -Uninstall

macOS Notes

macOS .pkg installers (cynative_Darwin_arm64.pkg for Apple Silicon, cynative_Darwin_x86_64.pkg for Intel) are available on the releases page. Install with:

sudo installer -pkg cynative_Darwin_arm64.pkg -target /

Or double-click the .pkg in Finder. These installers are signed, notarized, and stapled — there is no first-run Gatekeeper prompt.

The raw cynative_Darwin_*.tar.gz archives are also available for scripting and CI use. A quarantined tarball binary’s first GUI launch may trigger an online notarization check, but terminal use, install.sh, and Homebrew are unaffected.