Install & verify

murk ships as a single binary with no runtime dependencies. Pick whichever install method fits your setup.

Homebrew

brew tap interrupted-inc/murk && brew install murk

Cargo

Requires the Rust toolchain:

cargo install murk-cli

install.sh

Downloads a pre-built binary for your platform:

curl -fsSL https://raw.githubusercontent.com/interrupted-inc/murk/main/install.sh | sh

GitHub Releases

murk provides pre-built binaries for Linux (x86_64, aarch64, armhf), macOS (x86_64, Apple Silicon), and Windows on the releases page.

murk is also published to npm as @interrupted/murk-secrets and to PyPI as murk-secrets, if either fits your project’s toolchain better than a system-wide binary. Both read vault secrets from your code, and the Node package can store them too — see Library bindings for the API and usage.

Verify your download

Binary releases carry signed build provenance (actions/attest-build-provenance, backed by Sigstore/Fulcio). Verify a downloaded artifact with the GitHub CLI:

gh attestation verify murk-<version>-<target>.tar.gz --owner interrupted-inc

This confirms the artifact was produced by this repository’s release workflow: a builder you can inspect, with a signing identity an attacker cannot forge.

npm, PyPI, and crates.io releases each have their own verification path (npm provenance, PEP 740 attestations, and signed release tags respectively). See Verifying releases for the full walkthrough across every distribution channel.

Next steps

Once murk is installed, run through the quick start to generate a key and create your first vault.