Skip to content
GitmoapdocsBeta
Guide· How do I…?

Install the command-line tools

On this page you can9 tasks
Troubleshooting

Overview

Gitmoap ships two command-line programs, and you want both. gitmoap talks to the API — signing in, creating repositories, opening merge requests, watching a pipeline run. git-remote-gitmoap teaches your existing git to push to and clone from gitmoap:// addresses, so git push works the way it always has.

Every install channel below gives you both programs and the same binaries. Pick the one that matches how you already install software; there is nothing to choose between them beyond that.

Before you start

  • git must be installed.git-remote-gitmoap runs git to build and read the packs it transfers, so it is a requirement rather than a companion. Every packaged channel below installs it for you if it is missing; a downloaded archive does not.
  • You need a Gitmoap accountto sign in afterwards — sign up at gitmoap.com. There is nothing else to configure: the tools connect to Gitmoap on their own.
  • No account is needed to install.Everything below is a public download.

How to

Install on macOS

Homebrew installs Gitmoap on a Mac with Apple Silicon. The formula places a prebuilt binary, so the install takes seconds and puts no compiler on your Mac.

shellscript
brew tap gitmoap/tap https://get.gitmoap.com/homebrew-tap.git
brew trust gitmoap/tap
brew install gitmoap

Note

The brew trust line is a separate command on purpose. Homebrew asks you to trust any tap that is not one of its own before it will load formulae from it, and brew install fails with tap is not trusted until you do.

Install on an Intel Mac

There is no prebuilt binary for Intel Macs, so build the two programs from the source distribution. You need a Rust toolchain, which rustup installs.

shellscript
curl -fLO https://get.gitmoap.com/releases/0.0.1/gitmoap-0.0.1.tar.gz
curl -fLO https://get.gitmoap.com/releases/0.0.1/SHA256SUMS
shasum -a 256 -c --ignore-missing SHA256SUMS
tar xzf gitmoap-0.0.1.tar.gz
cd gitmoap-0.0.1
cargo install --locked --path crates/gitmoap-cli
cargo install --locked --path crates/git-remote-gitmoap

cargo install puts both programs in ~/.cargo/bin, which rustup adds to your PATH. The build takes a few minutes; nothing else is needed.

Install on Debian or Ubuntu

shellscript
sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://get.gitmoap.com/gitmoap.gpg \
| sudo tee /etc/apt/keyrings/gitmoap.gpg > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/gitmoap.gpg] https://get.gitmoap.com stable main" \
| sudo tee /etc/apt/sources.list.d/gitmoap.list
sudo apt update && sudo apt install gitmoap

Check the key against the fingerprint in Signing keys before you trust it. apt update fails with The repository … is not signed if the key did not install, which is the failure you want — it means nothing unverified was accepted.

Install on Fedora, RHEL or openSUSE

Download the .rpm for your architecture from the release page and install it:

shellscript
curl -fLO https://get.gitmoap.com/releases/0.0.1/gitmoap-0.0.1-1.x86_64.rpm
sudo rpm --import https://get.gitmoap.com/gitmoap.asc
sudo dnf install ./gitmoap-0.0.1-1.x86_64.rpm

Note

rpm -i on its own refuses the package, saying git is required. That is the packaging working: install through dnf or zypper and the dependency is resolved for you.

Install on Alpine

shellscript
wget -qO /etc/apk/keys/gitmoap.rsa.pub https://get.gitmoap.com/gitmoap.rsa.pub
echo "https://get.gitmoap.com/alpine/v3.21/main" >> /etc/apk/repositories
apk update && apk add gitmoap

Alpine verifies each package as well as the index, so apk add refuses anything the key above does not vouch for.

Install on Windows

Three package managers carry Gitmoap on Windows; any of them gives you the same binaries.

Chocolatey:

powershell
choco install gitmoap

Scoop:

powershell
scoop bucket add gitmoap https://get.gitmoap.com/scoop-bucket.git
scoop install gitmoap

winget:

powershell
winget install Gitmoap.gitmoap

Warning

Windows shows a SmartScreen warning the first time you run a downloaded Gitmoap binary, because the executables are not signed with an Authenticode certificate. Verify the download against its checksum instead — see Verify a download — and report anything that does not match rather than clicking through.

Install from an archive

Use this when your platform has no package, or when you want a specific version without a package manager.

shellscript
curl -fsSL https://get.gitmoap.com/install.sh | sh

The script picks the archive for your platform, checks it against the published checksum, tells you what it will install and where, and stops if anything does not match. --version installs a specific release, --bin-dir chooses where the programs go.

Warning

Piping a script into a shell trusts whatever the server sends you, protected by nothing but TLS. Download it, read it, then run it if you would rather not extend that trust:

shellscript
curl -fsSLO https://get.gitmoap.com/install.sh
less install.sh
sh install.sh

To do it by hand, download the archive for your platform, verify it, unpack it, and put both programs somewhere on your PATH:

shellscript
curl -fLO https://get.gitmoap.com/releases/0.0.1/gitmoap-0.0.1-x86_64-unknown-linux-musl.tar.gz
curl -fLO https://get.gitmoap.com/releases/0.0.1/SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
tar xzf gitmoap-0.0.1-x86_64-unknown-linux-musl.tar.gz
sudo install -m 0755 gitmoap-0.0.1-x86_64-unknown-linux-musl/gitmoap /usr/local/bin/
sudo install -m 0755 gitmoap-0.0.1-x86_64-unknown-linux-musl/git-remote-gitmoap /usr/local/bin/

Note

git-remote-gitmoap has to keep that exact name and be on your PATH. git finds it by name when it sees a gitmoap:// address, so renaming it or putting it somewhere git cannot see it is what causes git: 'remote-gitmoap' is not a git command.

Verify a download

Every release publishes a SHA256SUMS file listing each archive and its digest, and every channel above quotes the same numbers.

shellscript
sha256sum -c --ignore-missing SHA256SUMS

--ignore-missing checks the files you actually downloaded rather than failing on the ones you did not. A line ending OK is a match; anything else means you should not install what you have.

Check it worked

shellscript
gitmoap --version
git-remote-gitmoap --version

Both print the same version. Then sign in:

shellscript
gitmoap login
gitmoap doctor

gitmoap doctor checks the parts that are easy to get half-right — whether you are signed in, whether the remote helper is on your PATH under the name git looks for, and whether Gitmoap answers.

Reference

Channels

PlatformChannelWhat you get
macOSHomebrew tapA prebuilt binary for Apple Silicon; an Intel Mac builds from the source distribution
Debian, Ubuntuapt repositoryA signed .deb, updated by apt upgrade
Fedora, RHEL, openSUSE.rpm downloadA signed package, installed through dnf or zypper
Alpineapk repositoryA signed .apk, updated by apk upgrade
WindowsChocolatey, Scoop, wingetA downloaded archive, verified against its digest
Anything elseArchive or install scriptThe binaries, and a checksum file to verify them

Download layout

Everything is served from one host, and every path below is public.

PathHolds
/install.shThe install script
/releases/{version}/The archives for one release, and its SHA256SUMS
/latestThe current version number, one line. What the install script reads to decide what to fetch
/gitmoap.gpgThe public key apt verifies against, as a keyring
/gitmoap.ascThe same key, ASCII-armoured, for rpm --import
/gitmoap.rsa.pubThe public key apk verifies against
/homebrew-tap.gitThe Homebrew tap
/scoop-bucket.gitThe Scoop bucket
/alpine/{release}/main/{arch}/The apk repository
/dists/, /pool/The apt repository

Platforms

PlatformArchitectures
Linux (any distribution)x86_64, aarch64 — built against musl, so they run wherever Linux does
macOSarm64, prebuilt; x86_64, built from the source distribution
Windowsx86_64

Signing keys

Two keys sign what you install: an OpenPGP key for the apt repository and the rpm packages, and an RSA key for the apk packages and their index. The same key signs every package in its ecosystem, so you install one public key per package manager and it covers everything published afterwards.

The OpenPGP key is published twice, as the same key in two encodings, because apt and rpm each take one and refuse the other. gitmoap.gpg is the keyring apt names in signed-by=; gitmoap.asc is the armoured form rpm --import accepts.

Check the fingerprint you have against the one below before trusting a key:

OpenPGP C562 20FD 7E19 6582 10A4 BEEC 6ED5 5516 461B 8173
apk SHA256:9396d0f822d04ddb71ce26f2cb786bb52809a87829896805740b6a5aaab9d2a9
shellscript
gpg --show-keys --with-fingerprint gitmoap.gpg

Warning

A key downloaded from the same host as the packages proves only that the host is consistent with itself. Compare the fingerprint above against a source that is not that host before you trust a repository.

Troubleshooting

The repository … is not signed, or NO_PUBKEY
Cause
The apt key did not install, or landed in the wrong place
What to do
Re-run the curl … tee /etc/apt/keyrings/gitmoap.gpg step and confirm the file is there and non-empty, then sudo apt update
UNTRUSTED signature from apk
Cause
/etc/apk/keys/gitmoap.rsa.pub is missing
What to do
Download it again with the wget line above; the file name has to be exactly gitmoap.rsa.pub, because apk matches a signature to a key by its name
BAD signature from apk
Cause
The key in /etc/apk/keys/ is not the one that signed the packages
What to do
Replace it with the key from the download host and compare its fingerprint against Signing keys
git: 'remote-gitmoap' is not a git command
Cause
git-remote-gitmoap is not on your PATH, or was renamed
What to do
Put it on your PATH under exactly that name — git looks it up by name when it sees a gitmoap:// address. gitmoap doctor reports this
tap is not trusted from brew
Cause
The tap was added but not trusted
What to do
Run brew trust gitmoap/tap, then install again
brew install gitmoap says the arm64 architecture is required
Cause
The Mac has an Intel processor, and the formula carries the Apple Silicon binary
What to do
Build from the source distribution — see Install on an Intel Mac
SmartScreen warns about an unrecognised app
Cause
The Windows binaries carry no Authenticode signature
What to do
Verify the download against SHA256SUMS and run it if it matches
sha256sum: WARNING: 1 computed checksum did NOT match
Cause
The download is damaged or is not the file that was published
What to do
Delete it and download again. If it fails a second time, do not install it — report it
rpm --import says key 1 not an armored public key
Cause
You imported gitmoap.gpg, which is the keyring for apt
What to do
Import gitmoap.asc instead — the same key, in the encoding rpm accepts
rpm --checksig says SIGNATURES NOT OK
Cause
The signing key is not in rpm's keyring
What to do
sudo rpm --import https://get.gitmoap.com/gitmoap.asc, then check again. It should say digests signatures OK
rpm -i says git is required
Cause
The dependency is declared and rpm does not resolve dependencies
What to do
Install through dnf install ./gitmoap-*.rpm or zypper install, which do
gitmoap login says it could not reach Gitmoap
Cause
No network, or a firewall or proxy blocking api.gitmoap.com
What to do
Check that https://api.gitmoap.com opens from this machine, then run gitmoap doctor

Related

  • Repositoriescreate one and push to it, once the tools are installed
  • Access tokensfor a script or a build that cannot sign in interactively
  • How the CLI reaches Gitmoapwhat the tools resolved and from where, and how to point them at another environment for testing