Install tv (standalone binary)

Implementation status: the update engine, manifest schema, signing tooling, and release scripts this page describes are implemented and tested (issue #12), but no release has been published yet -- the download links below do not resolve to anything real until an operator creates the thalixinc/thalix-vault-releases repository, generates the production signing key, and cuts the first tag. See Releasing tv for that operator runbook. Until then, use Install and update from a private Git checkout if you have repository access.

This is the public distribution path for people without access to the private thalix-vault source repository: a single self-contained executable, no Node/npm/Git required at runtime, downloaded from public GitHub Releases on a dedicated thalixinc/thalix-vault-releases repository. Every release is Ed25519-signed; tv update verifies that signature, the artifact's exact size and SHA-256, its target platform, and that it is never a downgrade, before ever replacing the active binary -- see Command reference for tv update's full behavior and refusal codes.

Download

Pick your platform and run the matching commands. stable (the default channel) always resolves to the most recently published release.

macOS (Apple Silicon)

curl -fsSL -o tv "https://github.com/thalixinc/thalix-vault-releases/releases/latest/download/tv-darwin-arm64"
chmod +x tv
sudo mv tv /usr/local/bin/tv

macOS artifacts are code-signed but not yet notarized (Apple hasn't scanned them; see macOS code signing and notarization), so Gatekeeper will still refuse to run a freshly downloaded binary until you clear the quarantine flag yourself:

xattr -d com.apple.quarantine tv

Linux (x86_64)

curl -fsSL -o tv "https://github.com/thalixinc/thalix-vault-releases/releases/latest/download/tv-linux-x64"
chmod +x tv
sudo mv tv /usr/local/bin/tv

Windows (x86_64)

Invoke-WebRequest -Uri "https://github.com/thalixinc/thalix-vault-releases/releases/latest/download/tv-win32-x64.exe" -OutFile tv.exe

Windows builds are never signed (Thalix has no Authenticode code-signing certificate). Windows SmartScreen will show an "unrecognized publisher" warning on first run; choose "More info" then "Run anyway" if you trust the download, or verify its checksum first (below).

Verify the checksum

Every release publishes a SHA256SUMS file alongside the binaries. Download it and compare:

curl -fsSL -o SHA256SUMS "https://github.com/thalixinc/thalix-vault-releases/releases/latest/download/SHA256SUMS"
shasum -a 256 -c SHA256SUMS --ignore-missing   # macOS/Linux

(Get-FileHash tv.exe -Algorithm SHA256).Hash   # Windows -- compare by eye against SHA256SUMS

This checksum check is a convenience, not the load-bearing security guarantee: tv update itself independently verifies every artifact's Ed25519 signature and SHA-256 before ever activating it (see Command reference), so a corrupted or tampered _update_ can never silently install -- this manual check only covers the very first download, before tv exists on your machine to verify anything itself.

Verify the install

tv version --json

origin.source reports "standalone" for this install path, with the active binary's path and whether a previous version is retained for tv update --rollback.

Staying up to date

tv update [--json]
tv update --rollback [--json]

tv update fetches the current channel's signed manifest, verifies it, and atomically swaps in a newer version if one is available -- already-up-to-date if not, and it never downgrades. Exactly one prior version is retained; tv update --rollback restores it and re-verifies it starts up correctly. A failed or interrupted update always leaves the currently active version fully intact (see Command reference for the full refusal-code table).

Continue with CLI overview, Command reference, or Install and update from a private Git checkout for the alternative distribution path.