scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-09-23 00:41:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

docs(install): require gh or cosign for curl installer verify

Browse source 
Call out the provenance verifier prerequisite so curl|bash users
are not surprised by a fail-closed abort (#1267).
This commit is contained in:
mohammad junayd 2026-09-14 18:17:09 +04:00
parent aaae1a76ef
commit 1b74f806fc
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
docs/quickstart.mdx
View file

@ -7,6 +7,7 @@ description: "Install Strix and run your first security scan"
- Docker (running)
- An LLM API key from any [supported provider](/llm-providers/overview) (OpenAI, Anthropic, Google, etc.)
- For the curl installer: [GitHub CLI](https://cli.github.com/) (`gh`) or [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) — used to verify Sigstore provenance before extract
## Installation
@ -17,7 +18,8 @@ description: "Install Strix and run your first security scan"
```
The installer downloads the release archive, checks `SHA256SUMS`, then verifies
Sigstore provenance before extracting. To skip those checks (not recommended):
Sigstore provenance with `gh` or `cosign` before extracting. To skip those checks
(not recommended):
```bash
curl -sSL https://strix.ai/install | STRIX_INSTALL_SKIP_VERIFY=1 bash