> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cynative.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Install Cynative on macOS, Linux, and Windows

> Install the Cynative CLI via Homebrew, install script, Scoop, or manual download. Verify release signatures with Sigstore and Cosign for integrity.

Cynative ships as a single static binary with no runtime dependencies — no Node, no Python, no Docker. Drop it on your `PATH` and it's ready to run. Prebuilt binaries are published for macOS (Apple Silicon and Intel), Linux (x86\_64 and arm64), and Windows (x86\_64 and arm64).

<Tabs>
  <Tab title="macOS / Linux">
    **Homebrew (recommended)**

    Homebrew handles installation, updates, and uninstallation and verifies the download automatically:

    ```bash theme={null}
    brew install cynative/tap/cynative
    ```

    **Install script**

    The install script downloads the latest release archive and `checksums.txt` from GitHub, verifies the SHA-256 checksum before extracting, and installs the binary to `~/.local/bin` by default (no `sudo` required):

    ```bash theme={null}
    curl -fsSL https://raw.githubusercontent.com/cynative/cynative/main/install.sh | sh
    ```

    <Note>
      The install script verifies the downloaded archive's SHA-256 against the release `checksums.txt` before extracting — it fails closed if the checksum doesn't match. If the `gh` CLI is installed, it also checks the GitHub release attestation (advisory by default; set `CYNATIVE_REQUIRE_ATTESTATION=1` to make a failed check fatal).
    </Note>

    **Install script options:**

    | Variable | Default | Effect |
    | - | - | - |
    | `CYNATIVE_VERSION` | latest | Pin to a specific release tag (e.g. `v1.0.0`) |
    | `CYNATIVE_INSTALL_DIR` | `~/.local/bin` | Change the target installation directory |
    | `CYNATIVE_REQUIRE_ATTESTATION` | unset | Set to `1` to make a failed release attestation check fatal |

    For a high-integrity install, fetch the script from an immutable tag instead of `main`:

    ```bash theme={null}
    curl -fsSL https://raw.githubusercontent.com/cynative/cynative/<tag-or-sha>/install.sh | sh
    ```

    **Uninstall via install script:**

    ```bash theme={null}
    curl -fsSL https://raw.githubusercontent.com/cynative/cynative/main/install.sh | sh -s -- --uninstall
    ```
  </Tab>

  <Tab title="Windows">
    **Scoop (recommended)**

    ```powershell theme={null}
    scoop bucket add cynative https://github.com/cynative/scoop-bucket
    scoop install cynative
    ```

    **PowerShell install script**

    Downloads the latest release `.zip`, verifies the SHA-256 checksum, extracts the binary, installs it to `%LOCALAPPDATA%\cynative\bin`, and adds that directory to your user `PATH`:

    ```powershell theme={null}
    irm https://raw.githubusercontent.com/cynative/cynative/main/install.ps1 | iex
    ```

    <Note>
      Like the shell script, the PowerShell installer verifies the archive's SHA-256 against `checksums.txt` before extraction and fails closed on a mismatch. If the `gh` CLI is installed, it also checks the GitHub release attestation. Set `$env:CYNATIVE_REQUIRE_ATTESTATION = '1'` to make a failed attestation check fatal.
    </Note>

    **Uninstall via PowerShell script:**

    ```powershell theme={null}
    & ([scriptblock]::Create((irm https://raw.githubusercontent.com/cynative/cynative/main/install.ps1))) -Uninstall
    ```

    **PowerShell script options** (set as environment variables before running):

    | Variable | Default | Effect |
    | - | - | - |
    | `CYNATIVE_VERSION` | latest | Pin to a specific release tag |
    | `CYNATIVE_INSTALL_DIR` | `%LOCALAPPDATA%\cynative\bin` | Change the installation directory |
    | `CYNATIVE_REQUIRE_ATTESTATION` | unset | Set to `1` to make a failed attestation check fatal |
  </Tab>
</Tabs>

## Manual Download

Download a prebuilt binary and `checksums.txt` from the [releases page](https://github.com/cynative/cynative/releases), verify the SHA-256, and put the binary on your `PATH`.

**Linux:**

```bash theme={null}
grep cynative_Linux_x86_64.tar.gz checksums.txt | sha256sum -c -
```

**macOS:**

```bash theme={null}
grep cynative_Darwin_arm64.tar.gz checksums.txt | shasum -a 256 -c -
```

**Windows (PowerShell):**

```powershell theme={null}
(Get-FileHash .\cynative_Windows_x86_64.zip -Algorithm SHA256).Hash.ToLower()
Select-String -Path checksums.txt -Pattern cynative_Windows_x86_64.zip
```

Compare the hash output against the corresponding line in `checksums.txt` — they must match exactly.

## Verify Release Signatures

New releases ship a `checksums.txt.sigstore.json` file: a [Sigstore](https://www.sigstore.dev/) bundle signing `checksums.txt` with a keyless certificate bound to this repository's release workflow. Verifying it confirms that `checksums.txt` was produced by the official Cynative release pipeline and has not been tampered with — then you check your downloaded archive against that verified manifest.

```bash theme={null}
cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity "https://github.com/cynative/cynative/.github/workflows/release.yaml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

grep cynative_Linux_x86_64.tar.gz checksums.txt | sha256sum -c -      # Linux
grep cynative_Darwin_arm64.tar.gz checksums.txt | shasum -a 256 -c -  # macOS
```

Two limits worth knowing:

* `cosign` fetches Sigstore's trust root over the network unless you pass `--trusted-root`.
* Because the file names carry no version, the signature proves origin and integrity but not *which* release a loose set of files came from — the release URL or `gh release verify` is what binds a specific version.

The `.pkg` macOS installers are Developer ID signed, notarized, and stapled instead (see [macOS notes](#macos-notes) below), and every release asset is additionally covered by the GitHub release attestation (`gh release verify <tag>`).

## Updating and Uninstalling

| Method | Update | Uninstall |
| - | - | - |
| Homebrew | `brew upgrade cynative` | `brew uninstall cynative` |
| Install script | Re-run the one-liner | `curl -fsSL https://raw.githubusercontent.com/cynative/cynative/main/install.sh \| sh -s -- --uninstall` |
| Scoop | `scoop update cynative` | `scoop uninstall cynative` |
| PowerShell script | Re-run the one-liner | `& ([scriptblock]::Create((irm https://raw.githubusercontent.com/cynative/cynative/main/install.ps1))) -Uninstall` |

## macOS Notes

macOS `.pkg` installers (`cynative_Darwin_arm64.pkg` for Apple Silicon, `cynative_Darwin_x86_64.pkg` for Intel) are available on the [releases page](https://github.com/cynative/cynative/releases). Install with:

```bash theme={null}
sudo installer -pkg cynative_Darwin_arm64.pkg -target /
```

Or double-click the `.pkg` in Finder. These installers are **signed, notarized, and stapled** — there is no first-run Gatekeeper prompt.

The raw `cynative_Darwin_*.tar.gz` archives are also available for scripting and CI use. A quarantined tarball binary's first GUI launch may trigger an online notarization check, but terminal use, `install.sh`, and Homebrew are unaffected.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.