> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/setup-apps-os/cli-in-cicd/installing-the-cli.md). # Installing the Seal CLI Download and unpack the Seal CLI binary on Linux, macOS, or Windows. The Seal CLI is published as a single binary per platform: a zip on Linux and Windows, and a signed `.pkg` installer on macOS. You download it, place the binary on the `PATH`, and run it. Seal's releases are at [`github.com/seal-community/cli/releases`](https://github.com/seal-community/cli/releases). In CI/CD pipelines, the install is a step in the pipeline itself. See the per-platform integration pages ([GitHub Actions](/setup-apps-os/cli-in-cicd/github-actions.md), [GitLab CI](/setup-apps-os/cli-in-cicd/gitlab-ci.md), [Azure DevOps](/setup-apps-os/cli-in-cicd/azure-devops.md), [Jenkins](/setup-apps-os/cli-in-cicd/jenkins.md), [CircleCI](/setup-apps-os/cli-in-cicd/circleci.md), [Dockerfile](/setup-apps-os/cli-in-cicd/dockerfile.md)) for the exact shape of that step on your platform. ## Linux ```bash curl -fsSL https://github.com/seal-community/cli/releases/download/latest/seal-linux-amd64-latest.zip -o seal.zip unzip seal.zip chmod +x seal ./seal version ``` The downloaded archive contains the `seal` binary. Place it on the `PATH` (for example, `mv seal /usr/local/bin/seal`) for system-wide use, or run it from the working directory as shown. ## Verifying the Linux download Linux releases are signed by Seal with [cosign](https://docs.sigstore.dev/cosign/). The archive contains a signature bundle, `seal.sigstore.json`, next to the `seal` binary. The signing key is held in AWS KMS and never leaves its hardware security modules. Every signature is also recorded in Sigstore's public transparency log, Rekor, and each release page links to its Rekor entries. To verify a download before running it, [install cosign](https://docs.sigstore.dev/cosign/system_config/installation/), then save Seal's public key as `seal-cli.pub`, download the latest Linux version, unzip it and verify the `seal` binary: ```bash echo "-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEYDZPJicyOmWP4o/Ul9joeSUMW3L L7vSXIFZ7UH01UfYw+jLnwYI3ELErC7aMFeGjGqA+GrACLrytNvWXqU4cQ== -----END PUBLIC KEY-----" > seal-cli.pub curl -fsSL https://github.com/seal-community/cli/releases/download/latest/seal-linux-amd64-latest.zip -o seal.zip unzip seal.zip cosign verify-blob --key seal-cli.pub --bundle seal.sigstore.json seal ``` cosign prints `Verified OK`. Any other result means the binary was not signed by Seal, so don't run it. {% hint style="info" %} The [Seal GitHub Action](/setup-apps-os/cli-in-cicd/github-actions.md) runs this check automatically before it runs the CLI. {% endhint %} ## macOS The macOS CLI is a `.pkg` installer, on the [latest release](https://github.com/seal-community/cli/releases/tag/latest) for Apple Silicon (`arm64`) and Intel (`amd64`). Double-click it to install, or install it from a terminal; the binary lands at `/usr/local/bin/seal`: ```bash curl -fsSL https://github.com/seal-community/cli/releases/download/latest/seal-darwin-arm64-latest.pkg -o seal.pkg sudo installer -pkg seal.pkg -target / seal version ``` For an Intel Mac, swap `arm64` for `amd64` in the URL. To use the binary without installing it (no `sudo`), unpack the package instead; the binary is at `seal-pkg/Payload/seal`: ```bash pkgutil --expand-full seal.pkg seal-pkg ./seal-pkg/Payload/seal version ``` ## Verifying the macOS installer The installer and the `seal` binary inside it are signed with Seal's Apple Developer ID, and the installer is notarized by Apple. macOS checks this when you double-click the installer. To check it yourself before installing: ```bash pkgutil --check-signature seal.pkg ``` The output must include `Status: signed by a developer certificate issued by Apple for distribution`, `Notarization: trusted by the Apple notary service`, and `Developer ID Installer: Seal Cybersecurity Solutions, Inc. (SNZS6SJMFA)`. After installing, `codesign -dv /usr/local/bin/seal` prints `TeamIdentifier=SNZS6SJMFA` for the binary. {% hint style="info" %} The [Seal GitHub Action](/setup-apps-os/cli-in-cicd/github-actions.md) runs these checks automatically on macOS runners before it runs the CLI. {% endhint %} ## Windows The Windows binary is `amd64` (x86-64), published as both a `.zip` and a standalone `seal-windows-amd64-latest.exe` on the [latest release](https://github.com/seal-community/cli/releases/tag/latest). ```powershell Invoke-WebRequest -Uri https://github.com/seal-community/cli/releases/download/latest/seal-windows-amd64-latest.zip -OutFile seal.zip Expand-Archive seal.zip -DestinationPath . .\seal.exe version ``` The archive contains the `seal.exe` binary. Run it from the working directory as shown, or add its directory to the `Path` environment variable for use anywhere. ## Verifying the Windows download Windows releases are signed by Seal with [cosign](https://docs.sigstore.dev/cosign/), with the same key as the Linux releases (see [Verifying the Linux download](#verifying-the-linux-download)). The archive contains a signature bundle, `seal.exe.sigstore.json`, next to `seal.exe`, and each release page links the Rekor entry. To verify a download before running it, [install cosign](https://docs.sigstore.dev/cosign/system_config/installation/), then in PowerShell save Seal's public key as `seal-cli.pub`, download the latest Windows version, unzip it and verify `seal.exe`: ```powershell Set-Content -Path seal-cli.pub -Value @" -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEYDZPJicyOmWP4o/Ul9joeSUMW3L L7vSXIFZ7UH01UfYw+jLnwYI3ELErC7aMFeGjGqA+GrACLrytNvWXqU4cQ== -----END PUBLIC KEY----- "@ Invoke-WebRequest -Uri https://github.com/seal-community/cli/releases/download/latest/seal-windows-amd64-latest.zip -OutFile seal.zip Expand-Archive seal.zip -DestinationPath . cosign verify-blob --key seal-cli.pub --bundle seal.exe.sigstore.json seal.exe ``` cosign prints `Verified OK`. Any other result means the binary was not signed by Seal, so don't run it. {% hint style="info" %} The cosign signature is Seal's own; Windows doesn't check it. The binary isn't Authenticode-signed, so Windows SmartScreen may warn on first run. The `gradle` and `bundler` package managers are not yet supported on Windows; running the CLI against a Gradle or Bundler project on Windows prints a "not yet supported on Windows" message. The other supported package managers behave as they do on Linux and macOS. {% endhint %} ## Verifying the install ```bash seal version ``` The command prints the installed version. If the output is a version string, the install is good. ## Use the latest version For new installs, use `latest`. The Seal CLI deprecates older versions over time, so a build that pins an old version eventually stops working as the platform moves forward. The recommended practice is to use whatever the `latest` URL resolves to, and to refresh the install whenever the CLI changes underneath your build. If you have a strong operational reason to pin (a regulated environment with a frozen build chain, for example), pin to a recent version and treat the pin as a renewal commitment: keep the pinned version no more than six months old, and upgrade on a regular cadence. ## Related * [The CLI fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md): what to pass next, once the CLI is on the `PATH`. * [Network requirements](/reference/network-requirements.md): the hostnames the CLI host needs reachable. * The per-platform CI integration pages for pipeline-step shapes.