CLI Installation - Chainloop Documentation

You can install the Chainloop CLI using one of the following methods:

Chainloop SaaS
On-Prem
Manual Download

The install script comes pre-configured for Chainloop Cloud.

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s

Advanced Options

you can install a specific version with

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --version vx.x.x

and customize the install path (defaults to /usr/local/bin)

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --path /my-path

To install without sudo, provide a user-accessible path:

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --path ~/.local/bin

if cosign is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the —force-verification flag.

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --force-verification

To install the open-source edition instead:

curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s -- --oss

Two things have to be true before the CLI can talk to your instance: the binary is installed, and it points at your instance’s endpoints. Installing from your own instance’s domain does both in a single command.

Download and configure the CLI

Install from your own instance’s domain and the CLI is automatically configured to talk to it — there is nothing else to set up. Copy the exact command from the Chainloop web UI — click the terminal (>_) icon in the top-right corner — or replace YOUR_INSTANCE_DOMAIN below with your own.

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s

Terminal icon in the top-right corner of the Chainloop web UI that opens the CLI installation dialog

Advanced Options

you can install a specific version with

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --version vx.x.x

and customize the install path (defaults to /usr/local/bin)

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --path /my-path

To install without sudo, provide a user-accessible path:

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --path ~/.local/bin

if cosign is present in your system, in addition to the checksum check, a signature verification will be performed. This behavior can be enforced via the —force-verification flag.

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --force-verification

To install the open-source edition instead:

curl -sfL https://YOUR_INSTANCE_DOMAIN/cli/install.sh | bash -s -- --oss

Point the CLI at your instance — only if you installed it another way

Skip this if you used the command above. Run it when the CLI came from somewhere else — dl.chainloop.dev, a package manager, or a Manual Download — or when you want to switch an existing install to a different instance.

chainloop config save \
  --control-plane my-controlplane.acme.com:443 \
  --artifact-cas cas.acme.com:443 \
  --platform my-platform.acme.com:443

Confirm which instance the CLI is talking to with chainloop config view.

Download the CLI binary directly and verify its SHA256 against the published checksums.txt. Use this when piping a script into bash is not an option, or when binaries need to be validated out-of-band.

v1.141.0

OS	Architecture	Download	SHA256
Linux	Intel (amd64)	chainloop-linux-amd64	`29c106f0f0aab5bb2c2ecf614105daa9975e3cfcc0be01f3a32d059acbbcfb0c`
Linux	ARM64	chainloop-linux-arm64	`fee123ee097d85e1a9fb34ce7639b1e25e6d10b8d8935c4a3a57ad4907cc086b`
macOS	Intel (amd64)	chainloop-darwin-amd64	`0bc95d872bf6ec7202a7dd78ec3254f32246b5c867e0bb137a56e41c79ddd10a`
macOS	Apple Silicon	chainloop-darwin-arm64	`0181b81153c5ac1411ed88613d71dc92ec58ee5ce7e602576e18a4db680839c7`
Windows	Intel (amd64)	chainloop-windows-amd64.exe	`9342a7e389e573039c951bf121d663838a8a9696f1450fdeaa2d342adb48d03e`
Windows	ARM64	chainloop-windows-arm64.exe	`61f7ddf59350e320bb9c7c9a1b2902459e15d68bed3f2fbaa7e3b81ed96a4996`

Full manifest: checksums.txt · signature bundle · Release notesDownload, verify, and install (linux/amd64 shown — swap chainloop-linux-amd64 for another row from the table above):

VERSION=v1.141.0
BASE=https://chainloop-baafegchfnekdcde.z02.azurefd.net/public/chainloop-platform-cli/$VERSION

# Download the linux/amd64 binary and the checksum manifest
curl -fsSLO "$BASE/chainloop-linux-amd64"
curl -fsSLO "$BASE/checksums.txt"

# Download the signature bundle and confirm the manifest itself came from Chainloop's release pipeline
curl -fsSLO "$BASE/checksums.txt.sigstore.json"
cosign verify-blob \
  --bundle=checksums.txt.sigstore.json \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  --certificate-identity-regexp="^https://github.com/chainloop-dev/platform/\.github/workflows/release_backend\.yml@" \
  checksums.txt

# Verify the binary against the manifest
sha256sum --ignore-missing -c checksums.txt
# on macOS: shasum -a 256 --ignore-missing -c checksums.txt

# Install it onto your PATH
chmod +x chainloop-linux-amd64
sudo mv chainloop-linux-amd64 /usr/local/bin/chainloop

Unlike the install script, a manually downloaded binary isn’t automatically configured for your instance. If you’re on an on-prem or dedicated instance, point the CLI at your instance’s endpoints (Chainloop SaaS users can skip this):

chainloop config save \
  --control-plane my-controlplane.acme.com:443 \
  --artifact-cas cas.acme.com:443 \
  --platform my-platform.acme.com:443