Skip to content

Commit fd4f6aa

Browse files
committed
Rewrite installation section of README
1 parent 3aee848 commit fd4f6aa

1 file changed

Lines changed: 26 additions & 3 deletions

File tree

README.md

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,32 @@ The Sentry Prevent CLI is responsible for uploading code coverage and test resul
1414

1515
# Installing
1616

17-
As of today, you are not able to install the Sentry Prevent CLI. We are planning to release it on the PyPI and for direct download in the near future.
18-
19-
If you're determined, you can build the CLI yourself from source by running `uv build` in the `prevent-cli` directory.
17+
### PyPI
18+
19+
```
20+
pip install sentry-prevent-cli
21+
```
22+
23+
### Binary
24+
25+
We build and publish binaries for Linux, MacOS, and Windows. See our GitHub Releases for the full list of OS/architecture combos we build for. We'll use our macos binary for demonstration purposes here:
26+
```
27+
curl -o sentry-prevent-cli -L "https://github.com/getsentry/prevent-cli/releases/latest/download/sentry-prevent-cli_macos"
28+
chmod +x sentry-prevent-cli
29+
```
30+
31+
#### Verifying the binary
32+
If you'd like, you may use Sigstore's Cosign to verify the integrity of your download against our provided Cosign bundles and identity details. For more information on Cosign along with installation instructions, see their [documentation](https://docs.sigstore.dev/cosign/system_config/installation).
33+
34+
First get the appropriate Cosign bundle from our GitHub Release assets. Appending `.bundle` to the binary URL will get you the right file.
35+
```
36+
curl -O -L "https://github.com/getsentry/prevent-cli/releases/latest/download/sentry-prevent-cli_macos.bundle"
37+
```
38+
Then, use `cosign` to verify the binary:
39+
```
40+
cosign verify-blob sentry-prevent-cli --bundle sentry-prevent-cli_macos.bundle --certificate-identity-regexp=^https://github.com/getsentry/prevent-cli --certificate-oidc-issuer=https://token.actions.githubusercontent.com
41+
```
42+
The OIDC identity here is associated with the specific workflow run that signs the binary. If this command says the binary is verified, you can trust you've recieved the same binary we built in our GitHub Actions workflow.
2043

2144
# Usage
2245

0 commit comments

Comments
 (0)