Start

Install the CLI

One line installs descant, a self-contained binary with nothing else to install. It downloads over HTTPS, verifies the checksum before anything is made executable, and runs the binary once before putting it on your PATH.

curl -fsSL https://descant.run/install.sh | sh

What the installer does

  1. Detects your operating system and CPU architecture and picks the matching binary.
  2. Reads the newest release tag from https://descant.run/dist/latest and refuses anything that is not a tag — an error page or a captive portal stops the install rather than becoming a download path.
  3. Downloads the binary and its SHA256SUMS, and verifies the SHA-256 before the file is made executable or moved anywhere. A mismatch refuses outright: nothing unverified is ever run.
  4. Stages the binary in the target directory, runs descant version there, and only then swaps it into place — so a download that cannot run on your machine never replaces a descant that works today.
  5. Tells you where it landed, and warns if a different descant earlier on your PATH would still win.

There is no fallback channel. If any step fails, the installer stops with a message saying what you can do about it; it never quietly tries something else.

Supported platforms

Linux and macOS, on x86_64 and arm64. The binaries are named for their target:

  • descant-linux-x64
  • descant-linux-arm64
  • descant-darwin-x64
  • descant-darwin-arm64

The installer needs curl or wget, and sha256sum or shasum.

Options

The environment variables, all optional:

  • DESCANT_VERSION — install this version (for example 0.1.0) instead of the newest.
  • DESCANT_INSTALL_DIR — install here instead of the default. Without it the installer uses the first writable directory of /usr/local/bin, /opt/homebrew/bin and ~/.local/bin.
  • DESCANT_DIST_BASE — download from somewhere else (default https://descant.run). For a mirror that serves the same layout. It must be an https:// URL, and the installer refuses anything else: the checksums come from the same host as the binary, so over plain HTTP one hop rewrites both and verifying proves nothing.
  • DESCANT_ALLOW_INSECURE_DIST_BASE — set to 1 to allow a DESCANT_DIST_BASE that is not HTTPS, for a mirror on a network you control. Every run then warns that it is doing so.
DESCANT_VERSION=0.1.0 DESCANT_INSTALL_DIR=$HOME/bin sh -c "$(curl -fsSL https://descant.run/install.sh)"

Installing by hand

The same steps without the script, for a machine where piping to a shell is not allowed. The layout is small and fixed: /dist/latest is one line of plain text naming the newest tag, and /dist/<tag>/ holds the binaries and their SHA256SUMS.

base=https://descant.run/dist
tag=$(curl -fsSL "$base/latest")        # -> cli-vX.Y.Z
asset=descant-darwin-arm64              # descant-<linux|darwin>-<x64|arm64>
curl -fsSLO "$base/$tag/$asset"
curl -fsSLO "$base/$tag/SHA256SUMS"
grep " $asset$" SHA256SUMS | shasum -a 256 -c -    # sha256sum -c - on Linux
chmod +x "$asset"
mv "$asset" /usr/local/bin/.descant.new                 # stage it on the target filesystem
/usr/local/bin/.descant.new version                     # a build that cannot run here stops now
mv /usr/local/bin/.descant.new /usr/local/bin/descant   # only then swap

After installing

Run descant --help, then follow the setup on the CLI reference — descant login for the key, which prompts for it without echoing and keeps it in the machine's own credential store, and one environment variable for the API origin, which is not a secret — and you are ready for descant run list. The operations behind every command are on the API reference.