Skip to main content
Version: v5.7.0

0.0 Install OpsChain

Included from Basic tier

After this you can: put the opschain binary on a macOS, Linux or Windows machine — through a package manager or from a verified download — and prove it runs with opschain version.

Before you start — a machine you can install software on, and a network path to GitHub (or, for an offline machine, a connected one you can copy a file from — see Offline machines below).

In the GUI: nothing yet — the GUI is served by the server you start in lesson 0.1, from this same binary.

OpsChain is one binary: the command-line client, the server (opschain server) and the runner (opschain runner). Every released version is published at github.com/LimePoint/opschain-releases/releases for six platforms — macOS, Linux and Windows on arm64 and amd64 — with a SHA256SUMS.txt file over every archive and a signature on that file. This page is generated from the release the documentation ships with — v5.6.1. Nothing on this page is typed by hand: the archive names, digests and signing identities come from the release itself.

The Download links below go through the OpsChain website, which counts the download and sends you on to the release asset; the package-manager and installer commands name the asset directly because those tools fetch it themselves.

1. macOS​

Download: opschain-v5.6.1-darwin-arm64.tar.gz (Apple silicon) · opschain-v5.6.1-darwin-amd64.tar.gz (Intel) — then verify and install as below.

With Homebrew:

brew tap limepoint/tap
brew trust limepoint/tap      # Homebrew 7 and later load a third-party tap only once you trust it
brew install limepoint/tap/opschain
opschain version

Homebrew verifies the archive's digest against the formula, which the release regenerates from SHA256SUMS.txt on every cut.

Without Homebrew — download, verify, install:

curl -fsSLO https://github.com/LimePoint/opschain-releases/releases/download/v5.7.0/opschain-v5.7.0-darwin-arm64.tar.gz
curl -fsSLO https://github.com/LimePoint/opschain-releases/releases/download/v5.7.0/SHA256SUMS.txt
shasum -a 256 --ignore-missing -c SHA256SUMS.txt
tar -xzf opschain-v5.7.0-darwin-arm64.tar.gz
sudo install -m 0755 opschain /usr/local/bin/opschain
opschain version

(Intel Macs: darwin-amd64 in both names.) The archive holds the one binary, opschain, at its root.

The macOS binaries are signed with the Apple Developer ID Developer ID Application: LimePoint Pty Ltd (5VMU6KAJU2) (Team ID 5VMU6KAJU2, certificate SHA-256 1D:77:8A:47:86:7C:74:64:6B:46:AD:57:97:4D:9B:6C:0B:28:CC:B9:CB:59:B9:B0:B5:AB:89:14:51:DB:77:4C) and notarised by Apple, so a downloaded binary runs without a Gatekeeper prompt. To see the signature yourself:

codesign -dv --verbose=2 ./opschain 2>&1 | grep -E 'Authority|TeamIdentifier'

Expect TeamIdentifier=5VMU6KAJU2.

A runner host installs the same binary — there is no runner package; opschain runner is this executable. Lesson 6.1 covers enrolling it.

2. Linux​

Download: opschain-v5.6.1-linux-amd64.tar.gz (amd64) · opschain-v5.6.1-linux-arm64.tar.gz (arm64) — then verify and install as below.

The archive, verified, then installed:

curl -fsSLO https://github.com/LimePoint/opschain-releases/releases/download/v5.7.0/opschain-v5.7.0-linux-amd64.tar.gz
curl -fsSLO https://github.com/LimePoint/opschain-releases/releases/download/v5.7.0/SHA256SUMS.txt
sha256sum --ignore-missing -c SHA256SUMS.txt
tar -xzf opschain-v5.7.0-linux-amd64.tar.gz
sudo install -m 0755 opschain /usr/local/bin/opschain
opschain version

(arm64 machines: linux-arm64 in both names.)

Or the installer script, which does exactly those steps — resolves your platform, downloads the archive and SHA256SUMS.txt, verifies the digest before extracting anything, installs into /usr/local/bin (or ~/.local/bin when that is not writable — it never runs sudo itself) and prints the version. Download it, read it, then run it:

curl -fsSLO https://raw.githubusercontent.com/LimePoint/opschain-releases/main/install.sh
less install.sh
sh install.sh --version v5.7.0

sh install.sh --help lists --prefix, --from (an archive you copied in — see Offline machines) and the rest.

This release ships the archives only — no .deb/.rpm packages; a later release adds them beside the archives, installed as /usr/bin/opschain.

A runner host installs the same binary — there is no runner package; opschain runner is this executable. Lesson 6.1 covers enrolling it.

3. Windows​

Download: opschain-v5.6.1-windows-amd64.zip (amd64) · opschain-v5.6.1-windows-arm64.zip (arm64) — then compare the hash and extract as below.

With scoop:

scoop bucket add limepoint https://github.com/LimePoint/homebrew-tap
scoop install limepoint/opschain
opschain version

scoop verifies the zip's hash against the manifest, which the release regenerates from SHA256SUMS.txt on every cut.

Without scoop — download the zip and SHA256SUMS.txt, compare the hash, extract, and put the directory on your PATH:

Invoke-WebRequest https://github.com/LimePoint/opschain-releases/releases/download/v5.7.0/opschain-v5.7.0-windows-amd64.zip -OutFile opschain.zip
Invoke-WebRequest https://github.com/LimePoint/opschain-releases/releases/download/v5.7.0/SHA256SUMS.txt -OutFile SHA256SUMS.txt
(Get-FileHash .\opschain.zip -Algorithm SHA256).Hash.ToLower() -eq ((Select-String 'windows-amd64.zip' .\SHA256SUMS.txt).Line -split '\s+')[0]
Expand-Archive .\opschain.zip -DestinationPath "$env:LOCALAPPDATA\Programs\opschain"

The comparison prints True when the download is the published archive; do not extract it otherwise. (arm64 machines: windows-arm64.)

opschain.exe carries an Authenticode signature by LimePoint Pty Ltd (certificate SHA-256 15:BA:C2:9E:DF:D1:A1:AD:B4:FA:41:EE:CA:30:95:1D:05:FC:F9:D4:0A:A6:D2:CE:13:0B:AB:9B:8C:1D:7D:E3), so SmartScreen does not hold it. To see it: Get-AuthenticodeSignature .\opschain.exe | Format-List — expect Valid and that signer.

A runner host installs the same binary — there is no runner package; opschain runner is this executable. Lesson 6.1 covers enrolling it.

4. Verify what you downloaded​

Every lane above checks the archive's SHA-256 against SHA256SUMS.txt before anything is placed on the PATH — the package managers do it for you, the installer script does it before extracting, and the manual lanes show the command. The sums file itself is signed with the OpsChain release key; with cosign installed you can verify the signature too:

curl -fsSLO https://github.com/LimePoint/opschain-releases/releases/download/v5.7.0/SHA256SUMS.txt.sig
curl -fsSLO https://github.com/LimePoint/opschain-releases/releases/download/v5.7.0/opschain-release.pub
cosign verify-blob --key opschain-release.pub --signature SHA256SUMS.txt.sig SHA256SUMS.txt

The installer script runs this check on its own when cosign is installed. The release public key is fixed for every release — the opschain-release.pub you download must be exactly this (the installer carries the same key and refuses a release whose published key differs):

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJXPaHq0Cuu4aW4UcRTejUn3gtJOC
W3wbQa2FzE9u0cU9TRhU/gdg6+ZaBQ9arifgl9R+pVivMnrA7AjWUr2ltQ==
-----END PUBLIC KEY-----

The published digests for v5.6.1:

PlatformArchiveSHA-256
darwin/arm64opschain-v5.6.1-darwin-arm64.tar.gz236e3051447ff36816a9d63bc409ea3f4415ad9a214d5d3dadc6d2a6a409b333
darwin/amd64opschain-v5.6.1-darwin-amd64.tar.gzb769b9c480f12ef186f9ae0dd4b8909afe1e86eaddc67c8d505f673615b9eae3
linux/arm64opschain-v5.6.1-linux-arm64.tar.gza380098c2bc6348c9849d810009ef8019203515b838265ceadd3ce30a2f0445e
linux/amd64opschain-v5.6.1-linux-amd64.tar.gzc360c6cf3c1fc4f7e71993528f2db77aa2c1934cd3f5386f01f2c274a40509c3
windows/arm64opschain-v5.6.1-windows-arm64.zipc381e895126570e36e638f6b1ed85614a3cb52410bddbcc22495a876c5a0fbcc
windows/amd64opschain-v5.6.1-windows-amd64.zip351e8ed435007672795cba960f432b63b4abd2371e815a22c728e7b9f0ae62d2

5. Upgrade​

The package managers own upgrades:

brew upgrade opschain        # macOS (Homebrew)
scoop update opschain        # Windows (scoop)
sh install.sh                # Linux: re-run the installer for the latest release

A manual install is upgraded by repeating the download-verify-install steps with the new version. Upgrade a server or a runner in a maintenance window: stop it, replace the binary, start it (lesson 6.5 covers rolling a fleet).

6. Offline machines​

Download the archive and SHA256SUMS.txt on a connected machine, verify there, and copy both files across. The installer accepts a copied archive and still checks it against the copied sums file:

sh install.sh --from ./opschain-v5.7.0-linux-amd64.tar.gz

On macOS and Windows, run the manual verify-and-extract steps on the copied files.

7. The licence​

The binary runs without any licence document on the evaluation footprint — one project, one environment, one asset, one runner — and that footprint never expires. Registering the server for the free Basic tier (opschain admin licence register --email <you@company>; it asks for your organisation, country and use case, emails a verification token, and applies the licence for you) lifts it to the Basic limits — three environments, three runners, the GitHub integration and the Academy — in return for the disclosed installation intelligence the command prints before you accept. An enterprise or pack licence is applied to a running server with opschain admin licence apply <file>; lesson 1.5 explains the tiers and the limits. Use of OpsChain is governed by the LimePoint EULA — opschain eula prints it.

Check yourself​

opschain version

prints the version you installed and its commit. If the shell cannot find opschain, the install directory is not on your PATH — the installer and the package managers tell you which directory they used.

What you learned​

  • OpsChain is one binary, published for six platforms at github.com/LimePoint/opschain-releases/releases.
  • macOS: brew tap limepoint/tap && brew trust limepoint/tap && brew install limepoint/tap/opschain; Windows: scoop from the same tap repository; Linux: the archive, install.sh or a .deb/.rpm.
  • Every lane verifies the digest against SHA256SUMS.txt before the binary lands on the PATH; the installer never extracts an unverified archive and never runs sudo itself.
  • A runner host installs the same binary; the package managers own upgrades; an offline machine takes a verified copy.

Next​

Lesson 0.1 — start a server of your own and sign in.