Part I · Day One · Getting it on your machine · p. 12–13

Three install paths, no daemon

Longer than the quickstart, with the parts that go wrong.

ShippedLinux and macOS, Intel and Apple Silicon. Windows is experimental.

Container use is supported and is the recommended way to try it if you do not want a binary on your host. No daemon, no service, no background process, nothing in your login items. Uninstall is deleting the binary and ~/.config/securegit plus ~/.local/share/securegit/audit.

Path A — release binary

Most auditable. Recommended for anyone who reads the rest of this magazine and takes it seriously. Every release ships with a CycloneDX SBOM, SHA256SUMS, and a Sigstore keyless signature (cosign).

Command

sha256sum -c SHA256SUMS --ignore-missing
cosign verify-blob \
  --certificate SHA256SUMS.pem --signature SHA256SUMS.sig \
  --certificate-identity-regexp 'github.com/armynikfelabs-tools/securegit' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS

Path B is the install script — fastest, reasonable for a laptop, not for a fleet. Path C is build from source with a Rust toolchain. For a fleet: package it, sign it, and distribute it the way you distribute everything else. A security tool installed by curl-pipe-shell across two hundred machines is a supply-chain finding of its own.

This matters for adoption more than it sounds. A tool that is trivially reversible gets tried. A tool that installs infrastructure gets a meeting.