Install

PackGuard ships as a single static Rust binary — the scanner, the CLI, and the embedded dashboard are the same executable. Pick whichever channel is easiest on your machine; the resulting packguard binary is identical.

Homebrew


brew tap Tmauc/packguard
brew install packguard

Homebrew pins a specific released version and upgrades when you brew upgrade. Recommended on macOS.

install.sh — `curl | sh`


curl -fsSL https://raw.githubusercontent.com/Tmauc/packguard/main/install.sh | sh

The script:

detects your OS + architecture,
downloads the matching release artifact from GitHub Releases,
verifies the SHA256 against the signed SHA256SUMS file (zero-trust),
installs into ~/.local/bin/ (no sudo) or /usr/local/bin/ if writable,
prints packguard --version to confirm.

Audit the script before piping if that matches your trust model — it lives in the repo at install.sh.

Docker


docker run --rm -v "$PWD":/workspace \
  ghcr.io/tmauc/packguard:latest scan /workspace

The published image is multi-arch (linux/amd64 · linux/arm64), ~46 MB distroless. For CI, pin :vX.Y.Z instead of :latest for reproducibility. A Docker Hub mirror at tmauc/packguard exists if that registry is already cached in your infra.

Cargo — from crates.io


cargo install packguard --features ui-embed

Compiles the CLI + the embedded dashboard. Requires Rust 1.94+. Use this when you want a local build — custom flags or unreleased commits — rather than a verified release artifact.

Without --features ui-embed, packguard ui only serves the REST API and expects a separate Vite dev server on :5173. Fine for dashboard development, not what most users want.

v0.2.0 rename

The crate is now published as packguard. Pre-0.2.0 releases sat under the old name packguard-cli — that name is yanked on crates.io to keep cargo install defaults pointing at the new one, but the legacy release remains installable if you pin it:


# Legacy 0.1.0 install (no new features land here)
cargo install packguard-cli --version 0.1.0 --locked

Everything else — the binary name, CLI flags, config format (outside the Phase 9b offset breaking change covered in Offset policy) — is unchanged.

Verify


packguard --version

prints the version shipped by the channel you installed. If the command isn’t found after install.sh, make sure $HOME/.local/bin is on your PATH.