Install Preflight

Use this guide to install the preflight CLI. For most users, the best path is to download a precompiled release, either through the one-line installer or directly from GitHub Releases.

Choose An Install Method

Install With The One-Line Script

macOS And Linux

Run:

curl -fsSL https://preflight.bluecadet.com/install.sh | sh

By default this installs to /usr/local/bin/preflight. Set PREFLIGHT_VERSION=v1.2.3 to install a specific release instead of the latest tag.

To install somewhere else:

PREFLIGHT_INSTALL_DIR="$HOME/.local/bin" \
  curl -fsSL https://preflight.bluecadet.com/install.sh | sh

Windows PowerShell

Run:

irm https://preflight.bluecadet.com/install.ps1 | iex

By default this installs to %LOCALAPPDATA%\preflight\preflight.exe and adds that directory to your user PATH. Set $env:PREFLIGHT_VERSION = "v1.2.3" first to pin a specific release.

Download Directly From GitHub Releases

Release assets are published at GitHub Releases.

Choose the archive for your operating system and architecture, then extract the binary to a directory on your PATH.

Current archive naming follows this pattern:

preflight_<OS>_<ARCH>.tar.gz
preflight_<OS>_<ARCH>.zip

Examples:

• preflight_Windows_x86_64.zip
• preflight_Windows_arm64.zip
• preflight_Darwin_x86_64.tar.gz
• preflight_Darwin_arm64.tar.gz
• preflight_Linux_x86_64.tar.gz
• preflight_Linux_arm64.tar.gz

After extraction, confirm the install:

preflight --version

Upgrade

Re-run the install script to replace the installed binary with the latest release:

curl -fsSL https://preflight.bluecadet.com/install.sh | sh

irm https://preflight.bluecadet.com/install.ps1 | iex

Set PREFLIGHT_VERSION (or $env:PREFLIGHT_VERSION) first to move to a specific release instead of the latest. If you installed by direct download, download the new archive and replace the binary the same way you installed it.

Confirm the new version:

preflight --version

Uninstall

Preflight is a single binary; removing it is the whole uninstall.

On macOS or Linux, delete the binary from the install directory:

sudo rm /usr/local/bin/preflight

On Windows, delete the install directory and, if you want, remove it from your user PATH (the installer added it):

Remove-Item -Recurse -Force "$env:LOCALAPPDATA\preflight"

Projects you created (playbooks, preflight.yml, state/, secrets/) live in your own repositories and are untouched by an uninstall. The action cache, if you fetched remote actions, lives at ~/.preflight/actions and can be deleted too.

Build From Source

Build from source if you are developing Preflight or need an unreleased change.

Prerequisites

• Go installed
• A checkout of this repository

Build The Primary Windows Targets

GOOS=windows GOARCH=amd64 go build -o dist/preflight-windows-amd64.exe .
GOOS=windows GOARCH=arm64 go build -o dist/preflight-windows-arm64.exe .

Build For Your Local Machine

go build -o dist/preflight .

Or use make:

make build-windows-amd64
make build-windows-arm64
make build-local

Verify Checksums And Signing (Optional)

Verification is optional for everyday installs — the install scripts already check the archive digest against the published checksum file. Use this section when your environment requires manually verified artifacts.

Preflight releases ship with:

• archive assets
• a checksum file generated by GoReleaser named preflight_checksums.txt
• a Sigstore bundle produced by cosign for the checksum artifact

The repository release workflow enables keyless signing with GitHub OIDC, and .goreleaser.yaml signs the checksum artifact using cosign.

1. Download The Release Files

From the release page, download:

• the archive for your platform
• the checksum file
• the checksum signature bundle with the .sigstore.json suffix

2. Verify The Archive Checksum

Use the checksum file to confirm the archive you downloaded matches the published digest.

On macOS or Linux:

shasum -a 256 <archive>

On Windows PowerShell:

Get-FileHash <archive> -Algorithm SHA256

Compare that digest to the matching line in the downloaded checksum file.

3. Verify The Signed Checksum Artifact With cosign

Use cosign verify-blob against the checksum file and its Sigstore bundle:

cosign verify-blob \
  --bundle <checksums-file>.sigstore.json \
  --certificate-identity-regexp 'https://github.com/bluecadet/preflight/.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  <checksums-file>

This verifies that the checksum file was signed through GitHub Actions using Sigstore’s OIDC flow.

Troubleshooting

The installer script cannot move the binary into the install directory

On macOS or Linux, the script installs to /usr/local/bin by default and may use sudo if needed. Set PREFLIGHT_INSTALL_DIR to a user-writable location if you prefer not to elevate.

preflight is installed but not found

Make sure the install directory is on your PATH, then open a new shell and run:

preflight --version

I want the safest manual path

Use the direct download flow, verify the checksum, verify the cosign bundle for the checksum file, then extract the binary yourself.

Related Docs

• Enable remote access on a Windows target