Install

Run these on the server. vps-ready is one static binary for Linux on x86_64 and arm64, with nothing else to install.

curl

$curl -fsSL https://github.com/bhimrazy/vps-ready/releases/latest/download/install.sh | sudo sh

Copy

read it first

$curl -fsSLO https://github.com/bhimrazy/vps-ready/releases/latest/download/install.sh$less install.sh$sudo sh install.sh

Copy

cargo

$cargo install vps-ready --locked

Copy

The install script downloads the release tarball for the machine, checks it against the SHA-256 embedded in the script, verifies the release signature when gh or cosign is installed, and copies the binary to /usr/local/bin. View the install script.

If cosign, or gh while logged in (gh auth status), is installed and the signature check fails, the install stops (use --skip-verify to override). A gh that is not logged in is skipped. With no usable tool, the script says so and continues: the binary is then checked only against the checksums embedded in the script, so verify the script itself (below) if that matters to you.

Option	What it does
--dry-run	Show what would be done, change nothing
--prefix DIR	Install directory (default: /usr/local/bin). Refused when group- or other-writable
--skip-verify	Install even if the signature check fails; the SHA-256 check still runs
--version	Print the version the script installs and exit

The command is also installed as vpsready, without the hyphen.

Where the binary lives matters

The safety timer runs the binary as root later, so apply refuses the admin user, SSH server config and firewall modules when the binary is under /home, /tmp, /var/tmp or /dev/shm, or when it or a parent directory is writable by anyone but root. The install script’s /usr/local/bin is fine. A cargo install as a normal user lands in ~/.cargo/bin, so copy the binary to /usr/local/bin before you use a profile.

Building with cargo needs a Rust toolchain on the server. Signed packages for apt, dnf and apk are planned for v0.5.

Check the install

vps-ready --version
sudo vps-ready detect

detect only reads: it prints the distro, init system, virtualization, effective SSH server config and listening ports. Next, run the Quick start, which starts with sudo vps-ready, the guided setup.

Upgrade

vps-ready never updates itself: it makes no network calls except package installs. To upgrade, run the same installer again. It writes the new binary next to the old one and renames it into place, so the swap is atomic.

$curl -fsSL https://github.com/bhimrazy/vps-ready/releases/latest/download/install.sh | sudo sh

Copy

Check with vps-ready --version, and see the releases for what changed. The installer only replaces the binary; your journal in /var/lib/vps-ready stays, so history and rollback --last keep working.

To pin a version or read the script first, download the versioned installer from its release instead of latest, for example https://github.com/bhimrazy/vps-ready/releases/download/v0.4.0/install.sh.

Verify the install script

install.sh is listed in checksums.txt, which is signed, so you can check the script before running it. Download the script, checksums.txt and its bundle from the same release (pin the version rather than using latest).

$V=0.4.0$B=https://github.com/bhimrazy/vps-ready/releases/download/v$V$curl -fsSLO $B/install.sh -O $B/checksums.txt -O $B/checksums.txt.sigstore.json$cosign verify-blob --bundle checksums.txt.sigstore.json --certificate-identity-regexp '^https://github.com/bhimrazy/vps-ready/\.github/workflows/release\.yml@refs/tags/v' --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt$sha256sum --check --ignore-missing checksums.txt

Copy

With gh instead of cosign: gh attestation verify install.sh --repo bhimrazy/vps-ready.

Verify a release by hand

Every release ships checksums.txt, a Sigstore bundle for it, and a GitHub build-provenance attestation for each tarball and for install.sh.

# 1. Checksums
sha256sum --check --ignore-missing checksums.txt

# 2. Signature on the checksums (keyless, signed by the release workflow)
cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/bhimrazy/vps-ready/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# 3. Build provenance for a tarball
gh attestation verify vps-ready-<version>-<target>.tar.gz --repo bhimrazy/vps-ready

The trust model of each install channel is in Supply chain and release.