Installation

One-liner (Linux / macOS)

curl -fsSL https://raw.githubusercontent.com/ikkun1222/trustless/main/scripts/install.sh | sh

To install without the setup prompt (for CI/Docker):

curl -fsSL https://raw.githubusercontent.com/ikkun1222/trustless/main/scripts/install.sh | sh -s -- --minimal

To upgrade an existing installation:

curl -fsSL https://raw.githubusercontent.com/ikkun1222/trustless/main/scripts/install.sh | sh -s -- --update

From source (Go 1.26+)

git clone https://github.com/ikkun1222/trustless
cd trustless && go build -o trustless .

Or install directly:

go install github.com/ikkun1222/trustless@latest

Note: go build without ldflags reports trustless dev. Release binaries embed the version via -ldflags "-X main.version=vX.Y.Z" (the release pipeline and make build VERSION=vX.Y.Z do this automatically).

Verifying release artifacts

Starting with v0.5.1, every release artifact (binaries, SHA256SUMS, SBOM) is signed with cosign keyless (OIDC, no key management). Verify before use:

# 1. Download the artifact + its signature and certificate
gh release download v0.5.1 -p 'trustless-linux-amd64*' -p 'SHA256SUMS*'

# 2. Verify the binary matches the published checksum
sha256sum -c <(grep 'trustless-linux-amd64' SHA256SUMS)

# 3. Verify the cosign signature (keyless: identity = GitHub Actions of ikkun1222/trustless)
cosign verify-blob --certificate trustless-linux-amd64.pem \
  --signature trustless-linux-amd64.sig \
  --certificate-identity-regexp '^https://github.com/ikkun1222/trustless/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  trustless-linux-amd64

Each release also ships an SPDX SBOM (trustless.sbom.spdx.json) generated with syft for supply-chain transparency.

Prerequisites

  • Go 1.26+ for building from source
  • pass (the standard Unix password manager) + gpg — the default credential backend
  • Environment variables only (no pass needed) when using backend = "env"
  • bw (Bitwarden CLI) required only when using backend = "bitwarden" (cloud store)

Backends are swappable via trustless config set backend <name>: pass (default), env, bitwarden. See docs/bitwarden-backend-design.md for the Bitwarden backend design.

← Docs