From 1b74f806fc6b79147e56836445f91dcb1f74b12b Mon Sep 17 00:00:00 2001
From: mohammad junayd <111487869+m-jay21@users.noreply.github.com>
Date: Mon, 14 Sep 2026 18:17:09 +0400
Subject: [PATCH] docs(install): require gh or cosign for curl installer verify

Call out the provenance verifier prerequisite so curl|bash users
are not surprised by a fail-closed abort (#1267).
---
 docs/quickstart.mdx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/quickstart.mdx b/docs/quickstart.mdx
index e5c834b8..48236e6c 100644
--- a/docs/quickstart.mdx
+++ b/docs/quickstart.mdx
@@ -7,6 +7,7 @@ description: "Install Strix and run your first security scan"
 
 - Docker (running)
 - An LLM API key from any [supported provider](/llm-providers/overview) (OpenAI, Anthropic, Google, etc.)
+- For the curl installer: [GitHub CLI](https://cli.github.com/) (`gh`) or [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) — used to verify Sigstore provenance before extract
 
 ## Installation
 
@@ -17,7 +18,8 @@ description: "Install Strix and run your first security scan"
     ```
 
     The installer downloads the release archive, checks `SHA256SUMS`, then verifies
-    Sigstore provenance before extracting. To skip those checks (not recommended):
+    Sigstore provenance with `gh` or `cosign` before extracting. To skip those checks
+    (not recommended):
 
     ```bash
     curl -sSL https://strix.ai/install | STRIX_INSTALL_SKIP_VERIFY=1 bash