Install

Download a release

Prebuilt binaries for Linux (x86_64, aarch64; static, no dependencies) and macOS (x86_64, Apple Silicon) are on the releases page, named tegata_<version>_<os>_<arch>. Each release has a SHA256SUMS signed with the release signing key, and GitHub artifact attestations that show the files were built by the release workflow of k-kawa/tegata:

v=0.3.1 p=linux_x86_64
gh release download v$v -R k-kawa/tegata -p "tegata_${v}_${p}" -p SHA256SUMS -p SHA256SUMS.minisig
minisign -V -P RWS+RgaPKYHijXCDQ/JCehzLyohjXERYxShqSb6lS71/MHaCS3agTxkB -m SHA256SUMS
grep " tegata_${v}_${p}$" SHA256SUMS | shasum -a 256 -c
gh attestation verify "tegata_${v}_${p}" -R k-kawa/tegata    # optional
install -m 0755 "tegata_${v}_${p}" /usr/local/bin/tegata

Then let tegata init install the providers (below).

Or build from source (Rust 1.87 or later): in a clone of k-kawa/tegata, cargo install --path crates/tegata, and the same for each provider you use.

Install the providers

A provider is either a command you installed yourself, or a source that tegata init installs from GitHub releases:

providers:
  cloudflare:
    source: github.com/k-kawa/tegata   # a GitHub repository
    version: "^0.3"                    # a version requirement (Cargo syntax: ^1.2, ~1.2, >=1, 1.2.3, *)
  example:
    source: github.com/someone/tegata-provider-example
    version: "1"
    public_key: "RWQ…"                 # the minisign public key its author publishes
  local:
    command: ./bin/my-provider          # relative to this YAML if it has a `/`, otherwise from PATH

The official releases are signed with the key in SECURITY.md, which tegata has built in.

tegata init:

picks the newest release that matches version (or keeps the one in tegata.lock),
downloads SHA256SUMS and checks its minisign signature with public_key (for github.com/k-kawa/tegata, the official key built into tegata),
downloads the executable for this machine and checks it against SHA256SUMS,
records the version and the SHA-256 for every platform in tegata.lock.

Commit tegata.lock. Other machines that run tegata init then get the same files, checked against the lock, and tegata refuses a release whose files changed after you locked it. tegata init --upgrade moves to the newest matching versions. Other commands use only installed providers that match the lock; if anything is missing or changed, they ask you to run tegata init. tegata render never runs providers, so servers that only render need no init.

Environment variable	Use
`TEGATA_CACHE_DIR`	Where providers are installed (default: `$XDG_CACHE_HOME/tegata`, or `~/.cache/tegata`)
`TEGATA_PROVIDER_MIRROR`	Install from a local directory instead of GitHub, laid out as `<dir>/<source>/<version>/<file>` (for machines without internet access)
`GITHUB_TOKEN`	Sent to GitHub (optional). Needed for private repositories. Without it, tegata init uses the API only for the list of releases and downloads files from the public download URLs, which keeps it well under GitHub’s limit for unauthenticated requests
`TEGATA_GITHUB_API`	The GitHub API URL (default `https://api.github.com`)
`TEGATA_GITHUB_DOWNLOAD`	The base of the public download URLs (default `https://github.com`)

Publishing your own provider: see publishing providers.