Install

curl -fsSL https://install.enscrive.io/install.sh | sh

That is the canonical install command. It installs one thing: the enscrive CLI binary, at ~/.local/bin/enscrive. No sudo, no package manager, no daemon.

Before you run it

You need curl, and either sha256sum or shasum — the installer refuses to proceed if it cannot check the download’s hash.

You also need cosign. Signature verification is mandatory and fails closed, so a missing cosign is a hard error, not a warning. See Verification for why.

Published platforms today: x86_64-unknown-linux-gnu only. The installer detects aarch64 Linux, musl, and both macOS architectures and will install them the moment they are published, but the release pipeline currently builds that one Linux target. On anything else the one-liner will tell you no binary is available for your platform.

What it does

1. Detects your platform and maps it to a Rust target triple.
2. Fetches the release manifest from https://install.enscrive.io/releases/dev/latest.json and reads the URL and expected SHA256 for your platform.
3. Downloads the binary and checks its SHA256 against the manifest. A mismatch aborts the install.
4. Downloads the binary’s cosign bundle and verifies the signature. Any failure aborts the install.
5. Copies the verified binary to the install prefix and marks it executable.

Nothing else is installed. The three service binaries that make up a local stack — enscrive-developer, enscrive-observe, enscrive-embed — are not fetched here; enscrive init --mode self-managed fetches them later, from the same manifest. That later step checks each service binary’s SHA256 against the manifest and stops there: signature verification of the service binaries is not implemented yet (ENS-82), and the manifest itself is not signed. Everything under Verification describes the enscrive CLI binary that this installer places — not the service stack. See the quickstart.

Verification

install.enscrive.io is a CloudFront distribution with no WAF in front of it. Verification is the only thing standing between a tampered binary and an unattended curl | sh, so the installer treats it as load-bearing rather than advisory:

• SHA256 — checked against the manifest entry for your platform. Mandatory.

• cosign — keyless signature verification via Sigstore (Fulcio/Rekor). The certificate identity is pinned to this exact release workflow:

  identity:  ^https://github\.com/enscrive/enscrive-cli/\.github/workflows/release\.yml@refs/
  issuer:    https://token.actions.githubusercontent.com

  The pin is anchored at ^ and names the workflow file, not just the repo — a repo-only pin would accept a certificate minted by any workflow in the repository holding id-token: write, not only the release pipeline.

Three separate conditions each abort the install with a non-zero exit and nothing written to disk: cosign not on PATH, a bundle that cannot be downloaded, and a signature that does not verify.

--insecure

--insecure is the one documented bypass. It skips cosign verification entirely and prints a loud warning while doing so. The SHA256 check still runs. Use it only if you understand and accept the supply-chain risk — a hash checks that you got the file the manifest names, not that Enscrive published it.

Options

Pass flags through the pipe with sh -s --:

# Install somewhere else (default: ~/.local/bin)
curl -fsSL https://install.enscrive.io/install.sh | sh -s -- --prefix=/usr/local/bin

# Override platform detection, for cross-machine prep
curl -fsSL https://install.enscrive.io/install.sh | sh -s -- --target=x86_64-unknown-linux-gnu

# Skip cosign verification (see above — not recommended)
curl -fsSL https://install.enscrive.io/install.sh | sh -s -- --insecure

If your prefix is not on PATH, the installer says so and prints the line to add to your shell profile.

Confirm it worked

enscrive --version

A note on the URL

https://install.enscrive.io/install.sh is canonical. The extensionless https://install.enscrive.io/install is an alias kept for one-liners already in circulation; the publish step writes one object and server-side-copies it to the alias key, so the two cannot drift apart. Use the canonical form.

A shorter https://enscrive.io/install is planned but not provisioned — that URL does not resolve today.

Uninstall

The installer copies exactly one file, so removing the CLI is removing that file:

rm ~/.local/bin/enscrive

If you also ran a local stack, its containers are managed by your container runtime — shut them down there before removing anything. Then remove the state the CLI created outside your projects:

Per-project state lives in each project’s own .enscrive/ directory and goes away with the project.

Related: enscrive stop in the CLI reference.