Install

The CLI is distributed through dist.town itself — the same front door your releases will use.

Download

Archives come from the CLI’s own release page, dist-town/cli, named by platform:

Fetch yours — for example, on Linux x86-64:

curl -LO https://dist.town/graham.systems/dist-town/cli@latest/disttown-linux-amd64.tar.gz

Verify

Every release publishes checksums generated from its signed record — not from the storage that served the bytes, so a compromised host can’t forge them.

curl -LO https://dist.town/graham.systems/dist-town/cli@latest/SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

On macOS that’s shasum -a 256 -c SHA256SUMS --ignore-missing. Keep --ignore-missing either way: SHA256SUMS lists every platform’s archive, and without it the ones you didn’t download are reported as failures. You can also fetch a single artifact’s checksum by appending .sha256 to its URL.

Unpack and go

tar -xzf disttown-linux-amd64.tar.gz
./disttown login your-handle.example

Put the binary somewhere on your PATH, then head to Start here.

Stay current

disttown update

The CLI updates itself from its publisher’s repo: it resolves the publisher’s identity, follows the latest pointer, reads the release record, downloads the artifact for your platform, and checks what arrived against the record’s digest. No dist.town service is involved at any step. It states where the update comes from before it asks, and asks before replacing anything.

Both records are read with a proof, not on the server’s word: the PDS serves a signed commit and the tree path to the record, and the CLI checks the publisher’s signature and that inclusion itself. A PDS that served a forged release would fail that check rather than hand you a digest it made up. The pointer’s target is checked too — it has to name a release of the same project in the same repo, or the update stops.

• --check reports without acting: exit 0 when you’re already current, or when the target is yanked; exit 2 when an update is available.
• --channel beta follows that channel’s pointer instead of latest.
• --yes consents without prompting. Without it and without a terminal, update reports what it found and exits 2 rather than replacing anything.
• A dev build refuses to replace itself; use --check to report.

With Nix

The source on Tangled is a flake — build and install straight from it:

nix profile install 'git+https://tangled.org/graham.systems/dist-town#disttown'

Or try it without installing: nix run 'git+https://tangled.org/graham.systems/dist-town#disttown' -- login your-handle.example.

A binary in the nix store is immutable, so disttown update won’t replace it: it says so and points you back at nix (nix profile upgrade, or a rebuild from the flake). --check still works — nix builds stamp their version with a +nix suffix, and the check compares the release version underneath it, so a current flake install reports current.