Crossfyre CROSSFYRE
Start free
← Docs

Docs

Install the Crossfyre CLI

How to put the crossfyre CLI on a Linux host, check that what you downloaded is what Crossfyre published, and bring the host online as a node.

Platforms

Crossfyre publishes builds for Linux on x86-64 and 64-bit ARM. The binaries need glibc 2.34 or later.

The installer is tested on Debian 12, Ubuntu 22.04, Ubuntu 24.04 and Kali rolling. There is no macOS or Windows build; the end of this page says what to do instead. The commands below use curl and sudo.

The Workbench desktop app is published for Linux on x86-64 and 64-bit ARM. Its downloads and their sums are on its own page.

apt

On a system that uses apt, add the Crossfyre repository and install from it. apt then checks every package against the repository's archive key and updates them with everything else.

curl -fsSL https://bins.crossfyre.io/apt/crossfyre-archive-keyring.gpg | sudo tee /usr/share/keyrings/crossfyre-archive-keyring.gpg > /dev/null
sudo tee /etc/apt/sources.list.d/crossfyre.sources > /dev/null <<'EOF'
Types: deb
URIs: https://bins.crossfyre.io/apt
Suites: stable
Components: main
Signed-By: /usr/share/keyrings/crossfyre-archive-keyring.gpg
EOF
sudo apt update
sudo apt install crossfyre crossfyre-archive-keyring

The keyring holds one key, with the fingerprint 992F 106C 6CF0 32E4 3A3C A8BE D5D9 2DAC 3BA8 CDBF. With gnupg installed, gpg --show-keys /usr/share/keyrings/crossfyre-archive-keyring.gpg prints it. crossfyre-archive-keyring installs the same key at the same path, so a new key reaches you through apt upgrade.

The Workbench is in the same repository: sudo apt install crossfyre-workbench.

A .deb, without the repository

crossfyre 0.1.33 as a Debian package, for a machine you would rather not add a repository to. apt installs the libraries it needs. To update, install the next version's .deb the same way.

  • x86-64 crossfyre-v0.1.33-linux-x86_64.deb
    Download
    SHA-256 c243dd6a8747b1a5828d3ad19e8ace115d65e69f2b87537c6deb037381163eef
  • 64-bit ARM crossfyre-v0.1.33-linux-aarch64.deb
    Download
    SHA-256 6d4f8ccf4bd0d501fb3edae258c8a7fcb2ad5e66bed27a3c86e43c057e90ed93

Download it and SHA256SUMS, and install it only if the sum matches. uname -m fills in this machine's architecture, as the file names spell it:

curl -fsSLO https://bins.crossfyre.io/crossfyre/v0.1.33/crossfyre-v0.1.33-linux-$(uname -m).deb
curl -fsSLO https://bins.crossfyre.io/crossfyre/v0.1.33/SHA256SUMS
grep -F "  crossfyre-v0.1.33-linux-$(uname -m).deb" SHA256SUMS | sha256sum -c - && sudo apt install "./crossfyre-v0.1.33-linux-$(uname -m).deb"
Check SHA256SUMS against its signature

SHA256SUMS is signed with a Crossfyre release key, one the installer carries:

curl -fsSLO https://bins.crossfyre.io/crossfyre/v0.1.33/SHA256SUMS.sig
printf -- '-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA%s\n-----END PUBLIC KEY-----\n' 'kbMTWSxOuXPz8Wu8MMf552R66V5GivbTChZeyyoT3Sk=' > crossfyre-release.pem
base64 -d SHA256SUMS.sig > SHA256SUMS.sig.raw
openssl pkeyutl -verify -pubin -inkey crossfyre-release.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig.raw

OpenSSL 3.0 or later prints Signature Verified Successfully.

Or with the archive key, once its keyring is in place as in the apt section:

curl -fsSLO https://bins.crossfyre.io/crossfyre/v0.1.33/SHA256SUMS.asc
gpgv --keyring /usr/share/keyrings/crossfyre-archive-keyring.gpg SHA256SUMS.asc SHA256SUMS

gpgv prints Good signature. Debian 13 and Kali come with sqv instead: sqv --keyring /usr/share/keyrings/crossfyre-archive-keyring.gpg --signature-file SHA256SUMS.asc SHA256SUMS.

The installer

A script that puts crossfyre, node and cfx-script in /opt/crossfyre/bin and links crossfyre into /usr/local/bin. It says what it will do and asks before it changes anything. Before installing, it checks the release manifest's signature against the key written into the script, and each file's SHA-256 against the manifest. It needs curl, unzip, python3 and OpenSSL 3.0 or later. Download it, read it, then run it:

curl -fsSLO https://get.crossfyre.io/install.sh
less install.sh
sudo bash install.sh

The same in one line, once you have read it:

curl -fsSL https://get.crossfyre.io/install.sh | sudo bash

Other channels

  • Each CLI version as a GitHub release, with its .debs, tarballs and signed SHA256SUMS: clickswave/crossfyre-releases.
  • Coming The CLI on Arch Linux, from the AUR: crossfyre-bin.
  • Coming The Workbench on Arch Linux, from the AUR: crossfyre-workbench.
  • The CLI from Homebrew on Linux, run as your own user rather than as a node: clickswave/tap/crossfyre.
  • Coming The node as a container image: ghcr.io/clickswave/crossfyre-node.

For packagers

Every component is published as a tarball per platform, at a path made from its name and version, where arch is x86_64 or aarch64:

https://bins.crossfyre.io/<component>/v<version>/<component>-v<version>-linux-<arch>.tar.gz

Beside each version's files is a SHA256SUMS, signed with the release key in SHA256SUMS.sig and with the archive key in SHA256SUMS.asc. Each component also has a latest.json that names its current version and an index.html that lists each version published this way, for watch files: for the CLI, crossfyre/latest.json and crossfyre/index.html. Once published, a version's files never change.

A tarball holds the binary, LICENSE (Apache-2.0, for the source in the crossfyre-toolchain repository), BINARY-LICENCE.txt, which covers the binary itself, and THIRD-PARTY-NOTICES. Read BINARY-LICENCE.txt before you redistribute one.

ComponentVersion
crossfyre0.1.33
node0.1.43
ambulo0.0.17
voyage0.0.10
doorward0.0.10
toolmark0.0.9
plessor0.0.25
cfx-script0.1.2

crossfyre 0.1.33, for example:

packaging.json

A package that installs crossfyre says so in a packaging.json. Every command that would install, update or remove a component the package owns then leaves it to the package manager, names it, and carries on with the rest. crossfyre looks for the file at ../lib/crossfyre/packaging.json from the directory of its own executable, so /usr/lib/crossfyre/packaging.json for /usr/bin/crossfyre, and then in that directory itself.

{
  "manager": "pacman",
  "owns": ["crossfyre"]
}
manager
apt, pacman, brew, nix or container.
owns
The components the package installed: crossfyre, node, cfx-script or an engine.
bin_dir
Optional. Where node, cfx-script and the engines live instead of /opt/crossfyre/bin.
cli_path
Optional. The path to name the CLI by in a service unit, for a package whose binary sits at a path the next upgrade removes.

The file counts only when it is a regular file owned by root or by whoever owns the executable, and neither it nor its directory is writable by group or others.

After installing

Sign in, then bring the host online as a node:

crossfyre login
sudo crossfyre node init

crossfyre login asks how to sign in: approve this machine in a browser, from a link it prints, or paste an account key from Settings, CLI Access. Either way the key is never typed on a command line, so it stays out of your shell history.

A node keeps scan state in a Postgres database that runs as a Docker container, so install Docker first (docs.docker.com/engine/install). node init then claims a node for this host, installs its engines, starts the database and registers the node's service. More on nodes.

.cfx scripts need libpython3.11

cfx-script, which runs .cfx scripts, links libpython3.11, so a machine needs that library to run one. Debian 12 has it: sudo apt install libpython3.11. Ubuntu 24.04 and Kali rolling have no libpython3.11 package, so .cfx scripts do not run there yet; a later release will carry its own Python. The CLI, the node and the engines do not need it.

Updating and removing

  • Installed with the installer: crossfyre update all updates the CLI, the node and every engine, each checked against the signed manifest.
  • Installed from the repository: sudo apt update && sudo apt upgrade updates the CLI, and crossfyre update all then leaves the CLI to apt and updates the node and the engines.
  • sudo crossfyre uninstall stops and removes the node's service, the engines, the database container and the binaries it installed. Add --purge to delete the node registrations and settings as well.
  • Installed as a package: sudo apt remove crossfyre runs crossfyre uninstall --yes --keep-data before apt takes the package's own files away, so the node's service, the engines and the binaries the CLI fetched go with it. The database container, the node registrations and the settings are kept for a reinstall, and apt purge keeps them too. To delete them as well, run sudo crossfyre uninstall --purge before apt remove.

macOS and Windows

No build is published for either. On a Mac, run the CLI on a Linux host or in a Linux virtual machine. On Windows, WSL 2 gives you a Linux to run the commands above in (wsl --install), though it is not one of the tested setups.