Install the CLI

The seal CLI is a single static Go binary. It runs locally and in CI with no external dependencies.

The source lives at github.com/SamyGhannad/seal-cli.

Note

The current published release is v1.1.1. Pin release tags in CI or other repeatable environments; use @latest only when you intentionally want the newest published CLI.

Option 1: go install

Requires Go on PATH. For repeatable installs, pin a release tag:

go install github.com/SamyGhannad/seal-cli/cmd/seal@v1.1.1

For local experimentation, @latest installs the newest published release.

The binary lands in $GOBIN (or $GOPATH/bin). Make sure that directory is on your PATH:

export PATH="$(go env GOPATH)/bin:$PATH"
seal --version

Option 2: Build from source

git clone https://github.com/SamyGhannad/seal-cli.git
cd seal-cli
make build
./bin/seal --version

make build stamps the binary with git describe --tags --always --dirty so local builds report a useful version string.

To install into $GOBIN:

make install

To cross‑compile the five release targets (linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, windows/amd64) into bin/:

make release-snapshot

The release‑snapshot flags mirror the GitHub Actions release workflow, so local smoke tests catch flag‑related regressions before tagging.

Option 3: Prebuilt binaries

A GitHub Actions release workflow builds static binaries on git tag v* for:

• linux-amd64
• linux-arm64
• darwin-amd64
• darwin-arm64
• windows-amd64

Each release attaches the binaries and one .sha256 sidecar per binary. Pinning to a specific tag is recommended for CI:

SEAL_VERSION=v1.1.1
curl -L -o seal-linux-amd64 \
  "https://github.com/SamyGhannad/seal-cli/releases/download/${SEAL_VERSION}/seal-linux-amd64"
curl -L -o seal-linux-amd64.sha256 \
  "https://github.com/SamyGhannad/seal-cli/releases/download/${SEAL_VERSION}/seal-linux-amd64.sha256"
shasum -c seal-linux-amd64.sha256
chmod +x seal-linux-amd64
./seal-linux-amd64 --version

Adjust the asset name for your OS/arch, and check the releases page for newer published tags.

Verify the install

seal --help

You should see four subcommands:

• init: bootstrap seal.json in the current directory
• pin: pin or re‑pin bundles into seal.json
• verify: verify seal.json against the on‑disk state
• upgrade: update the CLI to the latest published release

Upgrade later

seal upgrade --check
seal upgrade

seal upgrade handles both install methods. Go-installed binaries are refreshed with go install ...@latest; prebuilt release binaries are replaced after downloading the matching GitHub Release asset and verifying its .sha256 sidecar.

Next: the quickstart walks through init → pin → verify on a real project.