Install

The CLI is a self-contained binary named viralquery. The recommended flow verifies the signed release manifest before executing the installer, then the installer verifies the selected binary's SHA-256 checksum before installing it. Install cosign first if it is not already available.

(
  set -eu
  VQ_VERSION=1.1.0
  VQ_BASE="https://cdn.viralquery.com/cli/v${VQ_VERSION}"
  VQ_TMP=$(mktemp -d "${TMPDIR:-/tmp}/viralquery-verify.XXXXXX")
  trap 'rm -rf "$VQ_TMP"' EXIT HUP INT TERM
  curl --proto '=https' --tlsv1.2 -fsSL "$VQ_BASE/install.sh" -o "$VQ_TMP/install.sh"
  curl --proto '=https' --tlsv1.2 -fsSL "$VQ_BASE/SHA256SUMS" -o "$VQ_TMP/SHA256SUMS"
  curl --proto '=https' --tlsv1.2 -fsSL "$VQ_BASE/SHA256SUMS.sigstore.json" -o "$VQ_TMP/SHA256SUMS.sigstore.json"
  cosign verify-blob "$VQ_TMP/SHA256SUMS" \
    --bundle "$VQ_TMP/SHA256SUMS.sigstore.json" \
    --certificate-identity "https://github.com/tfcbot/viralquery/.github/workflows/release.yml@refs/tags/v${VQ_VERSION}" \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com
  grep '  install.sh$' "$VQ_TMP/SHA256SUMS" > "$VQ_TMP/install.sh.sha256"
  if command -v sha256sum >/dev/null 2>&1; then
    (cd "$VQ_TMP" && sha256sum -c install.sh.sha256)
  elif command -v shasum >/dev/null 2>&1; then
    (cd "$VQ_TMP" && shasum -a 256 -c install.sh.sha256)
  else
    echo 'SHA-256 verifier not found.' >&2
    exit 1
  fi
  VIRALQUERY_CHECKSUMS_FILE="$VQ_TMP/SHA256SUMS" \
    VIRALQUERY_VERSION="$VQ_VERSION" \
    sh "$VQ_TMP/install.sh"
)

The certificate identity binds the manifest to ViralQuery's tagged GitHub Actions release workflow; verification uses public Sigstore/Rekor data and does not require repository access. Release assets live at immutable https://cdn.viralquery.com/cli/v<semver>/... paths.

The installer is idempotent when the same binary is already present. It refuses a different file, symlink, or non-file target by default. VIRALQUERY_FORCE=1 backs up a differing regular binary and then replaces it atomically. VIRALQUERY_INSTALL_DIR changes the destination; the advanced VIRALQUERY_CDN_BASE override should be used only for a mirror you explicitly trust. VIRALQUERY_CHECKSUMS_FILE gives the installer the already-Sigstore-verified local manifest, so it does not trust a newly downloaded manifest between verification and installation.

Do not pipe an unverified download directly into a shell. Download and verify the versioned installer first as shown above.

If ~/.local/bin isn't already on your PATH, add it:

export PATH="$HOME/.local/bin:$PATH"

Confirm the installed version with viralquery version, then connect it to the official API — see Auth.