rtunk installs from a release archive, with a version manager (mise, aqua), with go install, through the GitHub Action or in the dev container, on macOS or Linux.

go install github.com/axnic/rtunk/cmd/rtunk@latest
rtunk --version

--version reports the release tag for a release archive and for go install ...@<tag> (the version comes from the module's build information). A local go build carries no version metadata and prints dev: expected, not an error (resolveVersion() in cmd/rtunk/main.go). Releases are built by the Release workflow (Actions, Release, on GitHub) with GoReleaser (.goreleaser.yml) and published on the Releases page.

macOS and Linux only. Windows is not a supported host platform, a deliberate divergence recorded in ROADMAP.md, so neither path below is verified there. Release archives exist for darwin/amd64, darwin/arm64, linux/amd64 and linux/arm64; building from source works on any macOS or Linux architecture Go supports, since Go cross-compiles.

Each release at https://github.com/axnic/rtunk/releases ships one archive per platform, named rtunk-<tag>-<os>-<arch>.tar.gz (for example rtunk-v0.14.0-darwin-arm64.tar.gz), plus checksums.txt. Download the archive for your platform and checksums.txt, check the archive against the checksums, then extract the rtunk binary onto PATH:

tag=v0.14.0 os=darwin arch=arm64    # os: darwin|linux, arch: amd64|arm64
gh release download "$tag" -R axnic/rtunk -p "rtunk-$tag-$os-$arch.tar.gz" -p checksums.txt
sha256sum --ignore-missing -c checksums.txt        # shasum -a 256 -c on macOS
tar -xzf "rtunk-$tag-$os-$arch.tar.gz" rtunk
install -m 0755 rtunk ~/.local/bin/rtunk           # any directory on PATH
rtunk --version

The sha256sum check only proves the archive matches checksums.txt; it says nothing about who produced that file. Every release from v0.14.0 on is signed with cosign, ships an SBOM per archive and carries SLSA build provenance, so it can be verified against the Release workflow's identity: the steps are in SECURITY.md. Releases published before signing was added (v0.13.0 to v0.13.2) carry checksums.txt only, so the checksum comparison is the only check available for them.

rtunk is not in the central registry of any version manager yet, so both tools below read the GitHub release archives directly. Pin an exact version: it is what makes the install reproducible.

mise installs release archives through its github backend. In mise.toml (or .mise.toml):

[tools]
"github:axnic/rtunk" = "0.14.0"

or one-off, from the command line:

mise use "github:axnic/[email protected]"      # adds it to mise.toml and installs it
mise exec "github:axnic/[email protected]" -- rtunk --version

Run mise lock to record the archive checksums in mise.lock, so every machine and CI run installs the same bytes.

aqua has no axnic/rtunk entry in its standard registry, so declare the package in a local registry. registry.yaml:

packages:
  - type: github_release
    repo_owner: axnic
    repo_name: rtunk
    asset: rtunk-{{.Version}}-{{.OS}}-{{.Arch}}.tar.gz
    format: tar.gz
    files:
      - name: rtunk
    checksum:
      type: github_release
      asset: checksums.txt
      algorithm: sha256

aqua.yaml:

registries:
  - type: local
    name: rtunk
    path: registry.yaml
packages:
  - name: axnic/[email protected]
    registry: rtunk

aqua refuses packages from a registry it has not been told to trust, so add the registry to your policy file (aqua-policy.yaml, then aqua policy allow):

registries:
  - type: local
    name: rtunk
    path: registry.yaml
packages:
  - registry: rtunk

Then aqua i installs rtunk and verifies the archive against checksums.txt.

Neither tool checks the cosign signature or the build provenance: for that, follow SECURITY.md on a downloaded archive (v0.14.0 and later; releases before it have no signature to check).

This is the quickest path if you already have Go on PATH. It requires Go 1.27.0 or later, the floor declared in go.mod, and v0.14.0 or later (see the note at the top of this page). Pin a tag for a reproducible install; @latest resolves to the newest release.

go install github.com/axnic/rtunk/cmd/[email protected]

The Go module proxy and checksum database authenticate the source, but go install builds the binary on your machine: it carries no cosign signature, SBOM or provenance. Use a release archive when you need those.

This installs rtunk to $(go env GOBIN), or to $(go env GOPATH)/bin if GOBIN is unset. Make sure that directory is on PATH, then verify:

rtunk --version
rtunk help

help prints the full command list; Command Reference is the authoritative description of each command.

Use the repository's GitHub Action: it downloads the release archive, verifies it against checksums.txt, its cosign signature and its SLSA provenance, caches the tools and runs rtunk check:

- uses: axnic/[email protected]
  with:
    version: v0.14.0
    require-attestation: true

To install the binary only in a job, use the release archive or mise steps above.

.devcontainer/devcontainer.json describes the environment rtunk is developed in: a non-root Ubuntu image (amd64 and arm64) with git, gh, mise and the Go extension for VS Code. Open the repository in VS Code or Codespaces, or run the devcontainer CLI; on first creation it runs mise install, which resolves .mise.toml as pinned by mise.lock. It is meant for contributing to rtunk, not for running it elsewhere; see CONTRIBUTING.md.

Use this path to contribute, or to get the toolchain versions the project develops against. It is the setup CONTRIBUTING.md assumes, and it requires mise.

git clone https://github.com/axnic/rtunk.git
cd rtunk
mise trust    # if mise prompts about this repo's .mise.toml
mise install  # installs the Go toolchain and dev tools .mise.toml declares
go build -o rtunk ./cmd/rtunk
./rtunk --version

mise install resolves the toolchain declared in .mise.toml: the Go compiler (matching the go 1.27.0 floor in go.mod) and the dev tools. rtunk dogfoods itself: the binary you just built runs the lint stack of .rtunk/rtunk.yaml on its own source and docs (./rtunk fmt, ./rtunk check), downloading those linters into its cache on first use. The output of --version and help is the same as with go install.

Repeat the install option you used: download the new archive, bump the pinned version (mise, aqua, the Action's version), re-run go install .../rtunk@<new tag>, or git pull and rebuild. There is no rtunk upgrade command, by design: rtunk stays a local tool that makes no network call you did not explicitly trigger.

• Quickstart — run your first rtunk check in a few minutes
• Migrating from trunk — switch an existing trunk repository to rtunk
• GitHub Action — run rtunk in GitHub Actions
• Command Reference — every command and flag