Distribution and installation

Choose a binary deliberately. Neither line is production-ready or independently audited; the published prerelease does not acquire later source fixes.

Choice	Exact identity	Build features
Published prerelease	v0.10.0-alpha.2, release ID `383577232`, annotated tag object `c2c749c410b274c6719c586087e5d32f222ec8a2`, peeled commit `284a21a83191075615f2086ec935c6f3bf07c2bf`	Published alpha.2 `release-bundle` (six members; no WordPress support)
Preserved pinned source example (not current `main`)	`0.10.0-alpha.2` at `a29ba40c8cfdc7d0385431ea4d9e374e213ca4e0`	Default CLI build, or explicit `release-bundle`

Alpha.2 was published on 2026-09-06 with four native archives and a 478-byte SHA256SUMS whose SHA-256 is 9117984e31523aa4bfc751a182423efd2af0f1581883750fe4f3f2abf11d7499. Current main is the unreleased 0.10.0-alpha.3 development line. Main-workflow archives named with termivar-main-... remain temporary candidate evidence, not published release downloads.

For an already acquired current development executable, the one-command local demo runs python scripts/local_demo.py --binary PATH_TO_EXECUTABLE --output FRESH_DIRECTORY. It uses only the fixed benign loopback fixture, publishes one report bundle, checks no-overwrite, then shuts the fixture down before native offline Verify and self-Compare. It neither downloads/builds a candidate nor changes host security controls. Its observed version/hash and optional declared source ref remain separate; passing this demo is not archive provenance, complete feature qualification, publication, or S16 closeout. The preserved alpha.2 acquisition and walkthrough contracts below remain unchanged.

The CLI's default feature list is empty; its scanner dependency enables scanning and reporting. The current untagged alpha.3 development release-bundle additionally compiles artifact-adapter, normalization-resilience, graphql-review, openapi-review, rest-review, authorization-review, and the wordpress-review Preview. Compiling these features does not opt into their runtime actions: WordPress still requires explicit --profile web-review --wordpress-review. The development bundle excludes OAST, the legacy runner, the unsupported API listener, and the experimental proxy. The supplied-session Preview is likewise excluded and requires an explicit feature-enabled source build. Published alpha.2 archives retain their original six-member bundle and contain no WordPress producer or audit support.

The published alpha.2 executable and later development builds can report their own compile-time CLI surface states with termivar capabilities --format json. This is exact for that executable's termivar-cli feature gates only. In particular, release-bundle=compiled means the Cargo composition feature was selected; it is not evidence of an official release artifact, tested source SHA, or trusted provenance. Member features are reported independently, and no compiled state activates a runtime review. The historical alpha.1 binary and the pinned a29ba40... source binary in this guide predate the command; the published alpha.2 archives include it.

The historical alpha.1 archives predate PRs #109–#111. Alpha.2 includes those maintenance changes, but remains experimental, independently unaudited, and not production-ready. The walkthrough is credential-free and loopback-only. See the maintenance record for those fixes and the later development-source F3 polling repair. The published alpha.2 tag retains the historical source defect, while its downloadable release-bundle binaries did not compile ssrf-oast-review; no OAST setup is part of this guide.

Before either path

The archived binary needs no Rust toolchain. The walkthrough and archive inspection use Python 3.12.4 or newer, standard library only. Windows needs that minimum for the helper's private-directory creation. Source compilation also needs Git, Rust 1.88 or newer, and the platform's linker.

Use a reviewed checkout containing this guide, scripts/first_use.py, and scripts/verify_release_archive.py as the tools checkout. Git is needed to obtain that checkout; the scripts are not inside the published binary archive. If you do not already have one, start in a private, user-owned parent directory and clone into a new directory (the same commands work in PowerShell):

git clone https://github.com/ITherso/termivar.git termivar-first-use-tools
cd termivar-first-use-tools
git rev-parse HEAD

Run the remaining commands from that checkout's root. Inspect the scripts and record the full revision printed above; it identifies the tools you actually obtained, not the pinned source binary or the published release. If either script is absent, stop and obtain a reviewed tools checkout that contains them. The historical alpha.1 tag and pinned development revision below predate these walkthrough tools; do not switch this tools checkout to either older revision.

No step needs administrator privileges, global PATH changes, execution-policy changes, Gatekeeper bypass, or disabled antivirus/App Control. If host security blocks a binary, leave it blocked and report the unexecuted step.

Try the published prerelease

Download only your matching archive and the exact release's SHA256SUMS.

Platform	Archive
Linux x86_64 (GNU)	termivar-v0.10.0-alpha.2-x86_64-unknown-linux-gnu.tar.gz
macOS Apple Silicon	termivar-v0.10.0-alpha.2-aarch64-apple-darwin.tar.gz
macOS Intel	termivar-v0.10.0-alpha.2-x86_64-apple-darwin.tar.gz
Windows x86_64 (MSVC)	termivar-v0.10.0-alpha.2-x86_64-pc-windows-msvc.zip

The helper selects the single exact filename in the checksum manifest, rejects missing, duplicate, or malformed entries, and compares the archive digest. You do not need the other three archives. It then inspects the archive and refuses unexpected names, absolute/traversing paths, links, and an unexpected executable. Extraction re-verifies and uses a fresh private destination whose parent already exists and is trusted. It never overwrites, downloads, installs, or executes anything.

Checksum agreement checks bytes against the manifest, not independent safety or platform code signing. Build provenance is separate: see the release contract and GitHub's artifact-attestation verification guidance. Do not silently substitute another archive or a source build after a failure.

Linux and macOS

First select exactly one filename.

Linux x86_64:

ASSET="termivar-v0.10.0-alpha.2-x86_64-unknown-linux-gnu.tar.gz"

macOS Apple Silicon:

ASSET="termivar-v0.10.0-alpha.2-aarch64-apple-darwin.tar.gz"

macOS Intel:

ASSET="termivar-v0.10.0-alpha.2-x86_64-apple-darwin.tar.gz"

Then download and inspect. curl is an explicit acquisition prerequisite. The download directory must not already exist.

set -eu
RELEASE_URL="https://github.com/ITherso/termivar/releases/download/v0.10.0-alpha.2"
mkdir -m 700 first-use-downloads
curl --fail --location --proto '=https' --proto-redir '=https' --tlsv1.2 \
  --output "first-use-downloads/$ASSET" "$RELEASE_URL/$ASSET"
curl --fail --location --proto '=https' --proto-redir '=https' --tlsv1.2 \
  --output first-use-downloads/SHA256SUMS "$RELEASE_URL/SHA256SUMS"
python3 scripts/verify_release_archive.py \
  --archive "first-use-downloads/$ASSET" \
  --checksums first-use-downloads/SHA256SUMS

Review the inspection output before extracting to the new directory:

set -eu
python3 scripts/verify_release_archive.py \
  --archive "first-use-downloads/$ASSET" \
  --checksums first-use-downloads/SHA256SUMS \
  --extract-to termivar-alpha2
./termivar-alpha2/termivar --version
./termivar-alpha2/termivar --help
./termivar-alpha2/termivar scan --help

Expect version 0.10.0-alpha.2. Continue with the released-binary walkthrough.

Windows PowerShell

The download and extraction directories must not already exist. Use an installed Python 3.12.4+ interpreter as python.

$ErrorActionPreference = "Stop"
$asset = "termivar-v0.10.0-alpha.2-x86_64-pc-windows-msvc.zip"
$releaseUrl = "https://github.com/ITherso/termivar/releases/download/v0.10.0-alpha.2"
New-Item -ItemType Directory -Path first-use-downloads | Out-Null
Invoke-WebRequest -Uri "$releaseUrl/$asset" -OutFile "first-use-downloads/$asset"
Invoke-WebRequest -Uri "$releaseUrl/SHA256SUMS" -OutFile first-use-downloads/SHA256SUMS
python scripts/verify_release_archive.py --archive "first-use-downloads/$asset" --checksums first-use-downloads/SHA256SUMS
if ($LASTEXITCODE -ne 0) { throw "Archive inspection failed" }

Review the inspection output before the next commands:

python scripts/verify_release_archive.py --archive "first-use-downloads/$asset" --checksums first-use-downloads/SHA256SUMS --extract-to termivar-alpha2
if ($LASTEXITCODE -ne 0) { throw "Verified extraction failed" }
.\termivar-alpha2\termivar.exe --version
.\termivar-alpha2\termivar.exe --help
.\termivar-alpha2\termivar.exe scan --help

Expect version 0.10.0-alpha.2. Continue with the released-binary walkthrough. Published alpha.2 packaged-binary acceptance ran on all four native targets in Release workflow run 34032959112. The checked-in first-use sample provenance remains the earlier Windows alpha.1 capture and is not relabelled as alpha.2.

Build from source

Keep the walkthrough scripts in the tools checkout. The following preserved example clones a separate source tree at its concrete reviewed alpha.2 revision. It is not current main. These commands build package termivar-cli, whose executable is termivar.

Linux/macOS:

set -eu
SOURCE_COMMIT="a29ba40c8cfdc7d0385431ea4d9e374e213ca4e0"
git clone https://github.com/ITherso/termivar.git ../termivar-source-a29ba40
git -C ../termivar-source-a29ba40 checkout --detach "$SOURCE_COMMIT"
test "$(git -C ../termivar-source-a29ba40 rev-parse HEAD)" = "$SOURCE_COMMIT"
cargo build --locked --release -p termivar-cli \
  --manifest-path ../termivar-source-a29ba40/Cargo.toml \
  --target-dir ../termivar-source-a29ba40/target
../termivar-source-a29ba40/target/release/termivar --version

Windows PowerShell:

$ErrorActionPreference = "Stop"
$sourceCommit = "a29ba40c8cfdc7d0385431ea4d9e374e213ca4e0"
$sourceDir = "..\termivar-source-a29ba40"
if (Test-Path -LiteralPath $sourceDir) { throw "Choose a fresh source directory" }
git clone https://github.com/ITherso/termivar.git $sourceDir
if ($LASTEXITCODE -ne 0) { throw "Source clone failed" }
git -C $sourceDir checkout --detach $sourceCommit
if ($LASTEXITCODE -ne 0) { throw "Source checkout failed" }
if ((git -C $sourceDir rev-parse HEAD) -ne $sourceCommit) { throw "Source identity mismatch" }
cargo build --locked --release -p termivar-cli --manifest-path "$sourceDir/Cargo.toml" --target-dir "$sourceDir/target"
if ($LASTEXITCODE -ne 0) { throw "Source build failed" }
& "$sourceDir/target/release/termivar.exe" --version

Expect 0.10.0-alpha.2. A deliberately chosen alternative must also be a reviewed full commit: record it, inspect its manifest/features, build that exact tree, and pass its real ref/version to the runner. A commit pin is not an audit.

To compare the same source revision with the existing release bundle, build into a different output directory so the default binary is preserved:

cargo build --locked --release -p termivar-cli \
  --manifest-path ../termivar-source-a29ba40/Cargo.toml \
  --features release-bundle \
  --target-dir ../termivar-source-a29ba40/target/release-bundle

The resulting path is ../termivar-source-a29ba40/target/release-bundle/release/termivar (termivar.exe on Windows). PowerShell accepts the same command on one line. Label that source binary release-bundle, not a published-release binary. No optional runtime review flag is needed for the local example.

For a later reviewed source revision that exposes the command, inspect each separately built executable directly:

path/to/default/termivar capabilities
path/to/default/termivar capabilities --format json
path/to/release-bundle/termivar capabilities --format json

Do not infer feature parity from matching package versions. The inventory is self-reported build metadata, while the executable hash and source/build records remain separate evidence.

Verify the source-built binary

From the tools checkout, inspect the default source binary:

../termivar-source-a29ba40/target/release/termivar --help
../termivar-source-a29ba40/target/release/termivar scan --help

On Windows, use ..\termivar-source-a29ba40\target\release\termivar.exe. Then run the source-binary walkthrough. The runner checks the actual version and records the executable hash; ref and feature labels are explicit caller declarations, not facts inferred from help.

Release status and unsupported channels

The v0.10.0-alpha.2 prebuilt release is published and its support declaration is active. Current main is the unreleased 0.10.0-alpha.3 development line. The historical v0.9.0-alpha archives predate the deterministic-default remediation and are not an installation path for this guide. Future releases use the existing release process; this walkthrough changes no release or tag.

There is no supported Homebrew/Apt/AUR/Snap/Chocolatey/Scoop/crates.io package, repository installer, automatic updater, signed-platform binary channel, published Docker Hub/GHCR image, or cloud-marketplace deployment. Kubernetes, Helm, Terraform, Compose, and a PostgreSQL/Redis service stack are not supported installation paths. The historical root Compose manifest remains removed; the deployment blueprint is non-deployable reference material.

Local container build

The existing Dockerfile can package the CLI locally; it is not used by this native walkthrough or published to a registry by repository workflows.

docker build -t termivar:local .
docker run --rm termivar:local --help

Its default command is help, not a listener. The optional API and proxy adapters are not compiled into that image. See the runtime map before treating any compiled module as an executable product.

Reporting problems

Attach the actual version, OS/architecture, source or release ref, exit code, and redacted diagnostics. Never include credentials or private machine paths.