Installation

Choose a channel

mise (macOS and Linux)

mise use -g github:sebastienrousseau/corralctl

Installs the latest released corralctl and keeps it managed alongside your other mise tools.

Homebrew (macOS only)

brew install sebastienrousseau/tap/corralctl

This is a cask, which is a macOS-only mechanism — brew install on Linux will refuse it. On Linux use the .deb or .rpm packages, the tarballs attached to each release, mise, or the Go toolchain.

Arch Linux (AUR)

yay -S corralctl-bin

paru -S corralctl-bin works equally well.

Go toolchain

go install github.com/sebastienrousseau/corralctl/cmd/corralctl@latest

Installs into $(go env GOPATH)/bin, or $GOBIN when it is set.

A binary built this way reports corralctl version dev. The real version is stamped by the release pipeline through -ldflags, which go install does not apply — so if you need --version to mean something, take a release artefact instead.

From source

Requires Go 1.26 or newer, and Git:

git clone https://github.com/sebastienrousseau/corralctl.git
cd corralctl
make install

That installs to ~/.local/bin/corralctl.

Prerequisites

corralctl shells out to git, and authenticates through the GitHub CLI or a token. The table lists what to install first.

On Debian-family systems gh is not in the default archives; follow the GitHub CLI installation guide for it.

Verify the download

Every release publishes checksums.txt, signed with keyless cosign, and SLSA provenance as checksums.txt.intoto.jsonl. An artefact that was tampered with in transit fails verification rather than merely being inconvenient to intercept.

cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/sebastienrousseau/corralctl' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

Then check the archive itself against that file:

sha256sum --check checksums.txt --ignore-missing