Install & verify

murk ships as a single binary with no runtime dependencies. Pick whichever install method fits your setup.

Homebrew

brew tap iicky/murk && brew install murk

Cargo

Requires the Rust toolchain:

cargo install murk-cli

install.sh

Downloads a pre-built binary for your platform:

curl -fsSL https://raw.githubusercontent.com/iicky/murk/main/install.sh | sh

GitHub Releases

Pre-built binaries are available for Linux (x86_64, aarch64, armhf), macOS (x86_64, Apple Silicon), and Windows on the releases page.

murk is also published to npm as @iicky/murk-secrets and to PyPI as murk-secrets, if either fits your project’s toolchain better than a system-wide binary.

Verify your download

Binary releases carry signed build provenance (actions/attest-build-provenance, backed by Sigstore/Fulcio). Verify a downloaded artifact with the GitHub CLI:

gh attestation verify murk-<version>-<target>.tar.gz --owner iicky

This confirms the artifact was produced by this repository’s release workflow: a builder you can inspect, with a signing identity an attacker cannot forge.

npm, PyPI, and crates.io releases each have their own verification path (npm provenance, PEP 740 attestations, and signed release tags respectively). See Verifying releases for the full walkthrough across every distribution channel.

Next steps

Once murk is installed, run through the quick start to generate a key and create your first vault.