# Install (/docs/cli/install)



The CLI is a self-contained binary named `viralquery`. The recommended flow verifies the signed
release manifest before executing the installer, then the installer verifies the selected binary's
SHA-256 checksum before installing it. Install `cosign` first if it is not already available.

```bash
(
  set -eu
  VQ_VERSION=1.1.0
  VQ_BASE="https://cdn.viralquery.com/cli/v${VQ_VERSION}"
  VQ_TMP=$(mktemp -d "${TMPDIR:-/tmp}/viralquery-verify.XXXXXX")
  trap 'rm -rf "$VQ_TMP"' EXIT HUP INT TERM
  curl --proto '=https' --tlsv1.2 -fsSL "$VQ_BASE/install.sh" -o "$VQ_TMP/install.sh"
  curl --proto '=https' --tlsv1.2 -fsSL "$VQ_BASE/SHA256SUMS" -o "$VQ_TMP/SHA256SUMS"
  curl --proto '=https' --tlsv1.2 -fsSL "$VQ_BASE/SHA256SUMS.sigstore.json" -o "$VQ_TMP/SHA256SUMS.sigstore.json"
  cosign verify-blob "$VQ_TMP/SHA256SUMS" \
    --bundle "$VQ_TMP/SHA256SUMS.sigstore.json" \
    --certificate-identity "https://github.com/tfcbot/viralquery/.github/workflows/release.yml@refs/tags/v${VQ_VERSION}" \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com
  grep '  install.sh$' "$VQ_TMP/SHA256SUMS" > "$VQ_TMP/install.sh.sha256"
  if command -v sha256sum >/dev/null 2>&1; then
    (cd "$VQ_TMP" && sha256sum -c install.sh.sha256)
  elif command -v shasum >/dev/null 2>&1; then
    (cd "$VQ_TMP" && shasum -a 256 -c install.sh.sha256)
  else
    echo 'SHA-256 verifier not found.' >&2
    exit 1
  fi
  VIRALQUERY_CHECKSUMS_FILE="$VQ_TMP/SHA256SUMS" \
    VIRALQUERY_VERSION="$VQ_VERSION" \
    sh "$VQ_TMP/install.sh"
)
```

The certificate identity binds the manifest to ViralQuery's tagged GitHub Actions release workflow;
verification uses public Sigstore/Rekor data and does not require repository access. Release assets
live at immutable `https://cdn.viralquery.com/cli/v<semver>/...` paths.

The installer is idempotent when the same binary is already present. It refuses a different file,
symlink, or non-file target by default. `VIRALQUERY_FORCE=1` backs up a differing regular binary and
then replaces it atomically. `VIRALQUERY_INSTALL_DIR` changes the destination; the advanced
`VIRALQUERY_CDN_BASE` override should be used only for a mirror you explicitly trust.
`VIRALQUERY_CHECKSUMS_FILE` gives the installer the already-Sigstore-verified local manifest, so it
does not trust a newly downloaded manifest between verification and installation.

Do not pipe an unverified download directly into a shell. Download and verify the versioned
installer first as shown above.

If `~/.local/bin` isn't already on your `PATH`, add it:

```bash
export PATH="$HOME/.local/bin:$PATH"
```

Confirm the installed version with `viralquery version`, then connect it to the official API — see
**[Auth](/docs/cli/auth)**.