Install

Quick install (macOS and Linux)

curl -fsSL https://dl.flexgalaxy.ai/fgai/install.sh | bash
fgai version

The installer picks the archive for your platform, downloads SHA256SUMS from the same release prefix, and refuses to extract an archive whose digest does not match. If the GitHub CLI is installed and logged in, it also verifies the release’s signed build provenance and refuses an archive that does not verify — see What the installer checks below. It installs to /usr/local/bin by default; set PREFIX to install elsewhere:

curl -fsSL https://dl.flexgalaxy.ai/fgai/install.sh -o install.sh
PREFIX="$HOME/.local" bash install.sh

Make sure PREFIX/bin is on your PATH.

What the installer checks

The installer makes two checks, and they defend against different things.

The SHA-256 manifest is a transport check. SHA256SUMS is fetched from the same origin as the archive, so it detects a truncated or corrupted download — and nothing else. Anyone able to replace the archive on the download channel is able to replace the manifest beside it, so a matching digest is not evidence about who built the bytes.

The build-provenance attestation is an origin check. Every release archive carries a signed Sigstore attestation naming the repository, workflow and commit that produced it. That signature is not written by the download channel and cannot be forged by someone who controls it.

The installer verifies provenance when it can:

On your machine

What happens

gh installed and authenticated

Provenance is verified. A failure aborts the install — even though the checksum passed.

gh installed, not authenticated

Verification needs the GitHub API. The install proceeds and prints a warning saying only the transport checksum was checked.

gh not installed

Same warning. The install proceeds.

It is opportunistic on purpose: an installer that hard-required gh would refuse to run on the clean machine it exists to serve. It never degrades silently — an unverified install always says so on stderr.

To make verification mandatory (CI, a golden image, a locked-down workstation), set FGAI_REQUIRE_ATTESTATION=1 and the installer fails rather than warns:

curl -fsSL https://dl.flexgalaxy.ai/fgai/install.sh -o install.sh
FGAI_REQUIRE_ATTESTATION=1 bash install.sh

Other knobs: FGAI_SKIP_ATTESTATION=1 skips the origin check (it still warns), and FGAI_ATTESTATION_REPO overrides the repository whose attestations are trusted.

Download an archive directly

Latest release:

  • https://dl.flexgalaxy.ai/fgai/latest/fgai_Darwin_arm64.tar.gz (macOS Apple Silicon)

  • https://dl.flexgalaxy.ai/fgai/latest/fgai_Darwin_x86_64.tar.gz (macOS Intel)

  • https://dl.flexgalaxy.ai/fgai/latest/fgai_Linux_x86_64.tar.gz

  • https://dl.flexgalaxy.ai/fgai/latest/fgai_Linux_arm64.tar.gz

  • https://dl.flexgalaxy.ai/fgai/latest/fgai_Windows_x86_64.zip

Pin a version by replacing latest with a release tag. The current version is shown on dl.flexgalaxy.ai, and fgai version prints the one you have.

Each archive wraps the binary in a per-platform directory — fgai_<OS>_<arch>/fgai, or fgai.exe on Windows. Extract it and put the binary on your PATH.

Verify what you downloaded

Every release publishes a SHA256SUMS manifest beside the archives and carries a GitHub build-provenance attestation. To verify a Linux archive:

version=latest      # or a release tag, e.g. v0.1.7
curl -fSLO "https://dl.flexgalaxy.ai/fgai/$version/fgai_Linux_x86_64.tar.gz"
curl -fSLO "https://dl.flexgalaxy.ai/fgai/$version/SHA256SUMS"
grep '  fgai_Linux_x86_64.tar.gz$' SHA256SUMS | sha256sum --check --strict
gh attestation verify fgai_Linux_x86_64.tar.gz \
  --repo SiriusVoyager/fgai-cli \
  --signer-workflow SiriusVoyager/fgai-cli/.github/workflows/release.yml \
  --deny-self-hosted-runners

Windows

Download fgai_Windows_x86_64.zip from the release prefix above, extract fgai.exe into a directory on PATH (for example %USERPROFILE%\bin), then from PowerShell:

fgai.exe --help
fgai.exe version

Windows support is Tier 2 until browser login and shell behavior are fully validated.

go install does not work

Note

go install github.com/SiriusVoyager/fgai-cli/cmd/fgai@latest is not a supported path. fgai is composed from four Go modules, and none of them is publicly readable — the fetch fails before anything is built. Use the release channel above: it is the only supported way to get fgai, and the only one whose archives carry a checksum manifest and signed build provenance.

Which version am I running?

fgai version

fgai is composed from four repositories — the CLI framework plus the DotID, trustmint and bazaar command extensions — so a released binary also states which source went into it:

fgai --json version

The components array names each repository and the exact commit it was built from. A binary you built yourself omits it: a local build is composed from whatever is in your working trees, which is not a coordinate anyone can reproduce.

Compare it with the version shown on dl.flexgalaxy.ai. An older copy earlier on your PATH is the most common cause of a command that behaves unexpectedly; see Troubleshooting.