Install and update

Install

curl -fsSL https://tesser.sh/install | sh

The script installs tesser to ~/.tesser/bin and adds that directory to your shell’s rc file. To install a specific release:

curl -fsSL https://tesser.sh/install | sh -s -- v0.31.0

tesser update installs the latest release over the running binary and restarts the daemon on it; tesser update v0.31.0 installs that release.

Release API

https://install.tesser.sh serves the install script and answers the questions it asks. Every response is plain text.

Request	Response
`GET /`	The install script.
`GET /latest`	The newest stable version, for example `v0.31.0`.
`GET /<version>/<target>/sha`	The sha256 of that release’s tarball for that target.
`GET /<version>/<target>/download`	A redirect to the tarball, which holds one file: `tesser`.
`GET /<version>/manifest.json`	The release’s manifest: version, commit, and each target’s sha256 and size.
`GET /<version>/manifest.json.sig`	The manifest’s ed25519 signature, base64.

<target> is one of darwin-arm64, darwin-x64, linux-x64, linux-x64-baseline (x64 CPUs without AVX2), and linux-arm64. A version or target that does not exist returns 404. A published release never changes.

How updates are verified

Every release’s manifest is signed with Tesser’s release key, and the public half is compiled into the CLI. tesser update downloads the manifest and its signature, refuses a manifest the key did not sign, and checks the tarball against the sha256 in the signed manifest. Anyone who could change what install.tesser.sh or the download store serves still could not get an installed CLI to update to a build we did not sign. The install script does not check the signature: it trusts the sha256 that install.tesser.sh serves, like any curl | sh installer. To remove that trust from CI, pin the hash as below.

Pin a release in CI

To trust nothing but a hash in your own repository, hardcode the target and the sha256, and check the download against it:

- name: Install tesser
  run: |
    curl -fsSL https://install.tesser.sh/v0.31.0/linux-x64/download -o tesser.tar.gz
    echo "<sha256>  tesser.tar.gz" | sha256sum -c -
    tar -xzf tesser.tar.gz -C /usr/local/bin tesser
    tesser version

Get the value for <sha256> once from https://install.tesser.sh/v0.31.0/linux-x64/sha.

Get started

Guides

Reference

Concepts

Install and update

Install

Release API

How updates are verified

Pin a release in CI

​Install

​Release API

​How updates are verified

​Pin a release in CI

Install

Release API

How updates are verified

Pin a release in CI