# Install Preflight Use this guide to install the `preflight` CLI. For most users, the best path is to download a precompiled release, either through the one-line installer or directly from GitHub Releases. ## Choose An Install Method | Method | Best for | | ------------------------------------ | ------------------------------------------------ | | One-line install script | Fastest setup on a workstation | | Direct download from GitHub Releases | Controlled installs and manual verification | | Build from source | Contributors or users testing unreleased changes | > [!TIP] > The normal user path is a precompiled release. Building from source is optional. ## Install With The One-Line Script ### macOS And Linux Run: ```bash curl -fsSL https://preflight.bluecadet.com/install.sh | sh ``` By default this installs to `/usr/local/bin/preflight`. Set `PREFLIGHT_VERSION=v1.2.3` to install a specific release instead of the latest tag. To install somewhere else: ```bash PREFLIGHT_INSTALL_DIR="$HOME/.local/bin" \ curl -fsSL https://preflight.bluecadet.com/install.sh | sh ``` ### Windows PowerShell Run: ```powershell irm https://preflight.bluecadet.com/install.ps1 | iex ``` By default this installs to `%LOCALAPPDATA%\preflight\preflight.exe` and adds that directory to your user `PATH`. Set `$env:PREFLIGHT_VERSION = "v1.2.3"` first to pin a specific release. ## Download Directly From GitHub Releases Release assets are published at [GitHub Releases](https://github.com/bluecadet/preflight/releases). Choose the archive for your operating system and architecture, then extract the binary to a directory on your `PATH`. Current archive naming follows this pattern: ``` preflight__.tar.gz preflight__.zip ``` Examples: - `preflight_Windows_x86_64.zip` - `preflight_Windows_arm64.zip` - `preflight_Darwin_x86_64.tar.gz` - `preflight_Darwin_arm64.tar.gz` - `preflight_Linux_x86_64.tar.gz` - `preflight_Linux_arm64.tar.gz` After extraction, confirm the install: ```bash preflight --version ``` ## Upgrade Re-run the install script to replace the installed binary with the latest release: ```bash curl -fsSL https://preflight.bluecadet.com/install.sh | sh ``` ```powershell irm https://preflight.bluecadet.com/install.ps1 | iex ``` Set `PREFLIGHT_VERSION` (or `$env:PREFLIGHT_VERSION`) first to move to a specific release instead of the latest. If you installed by direct download, download the new archive and replace the binary the same way you installed it. Confirm the new version: ```bash preflight --version ``` ## Uninstall Preflight is a single binary; removing it is the whole uninstall. On macOS or Linux, delete the binary from the install directory: ```bash sudo rm /usr/local/bin/preflight ``` On Windows, delete the install directory and, if you want, remove it from your user `PATH` (the installer added it): ```powershell Remove-Item -Recurse -Force "$env:LOCALAPPDATA\preflight" ``` Projects you created (playbooks, `preflight.yml`, `state/`, `secrets/`) live in your own repositories and are untouched by an uninstall. The action cache, if you fetched remote actions, lives at `~/.preflight/actions` and can be deleted too. ## Build From Source Build from source if you are developing Preflight or need an unreleased change. ### Prerequisites - Go installed - A checkout of this repository ### Build The Primary Windows Targets ```bash GOOS=windows GOARCH=amd64 go build -o dist/preflight-windows-amd64.exe . GOOS=windows GOARCH=arm64 go build -o dist/preflight-windows-arm64.exe . ``` ### Build For Your Local Machine ```bash go build -o dist/preflight . ``` Or use `make`: ```bash make build-windows-amd64 make build-windows-arm64 make build-local ``` ## Verify Checksums And Signing (Optional) Verification is optional for everyday installs — the install scripts already check the archive digest against the published checksum file. Use this section when your environment requires manually verified artifacts. Preflight releases ship with: - archive assets - a checksum file generated by GoReleaser named `preflight_checksums.txt` - a Sigstore bundle produced by `cosign` for the checksum artifact The repository release workflow enables keyless signing with GitHub OIDC, and `.goreleaser.yaml` signs the checksum artifact using `cosign`. ### 1. Download The Release Files From the release page, download: - the archive for your platform - the checksum file - the checksum signature bundle with the `.sigstore.json` suffix ### 2. Verify The Archive Checksum Use the checksum file to confirm the archive you downloaded matches the published digest. On macOS or Linux: ```bash shasum -a 256 ``` On Windows PowerShell: ```powershell Get-FileHash -Algorithm SHA256 ``` Compare that digest to the matching line in the downloaded checksum file. ### 3. Verify The Signed Checksum Artifact With `cosign` Use `cosign verify-blob` against the checksum file and its Sigstore bundle: ```bash cosign verify-blob \ --bundle .sigstore.json \ --certificate-identity-regexp 'https://github.com/bluecadet/preflight/.*' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ ``` This verifies that the checksum file was signed through GitHub Actions using Sigstore’s OIDC flow. ## Troubleshooting ### The installer script cannot move the binary into the install directory On macOS or Linux, the script installs to `/usr/local/bin` by default and may use `sudo` if needed. Set `PREFLIGHT_INSTALL_DIR` to a user-writable location if you prefer not to elevate. ### `preflight` is installed but not found Make sure the install directory is on your `PATH`, then open a new shell and run: ```bash preflight --version ``` ### I want the safest manual path Use the direct download flow, verify the checksum, verify the `cosign` bundle for the checksum file, then extract the binary yourself. ## Related Docs - [Quickstart](/tutorials/quickstart/) - [Manage your first Windows target](/tutorials/first-windows-target/) - [Enable remote access on a Windows target](/how-to/enable-remote-access/)