---
title: "Install monedula-acl-rbac"
description: "Install the monedula-acl-rbac CLI with go install or a signed release archive, verify the cosign signature, and enable shell completion."
url: https://monedula.dev/flock/docs/acl-rbac-converter/how-to/install/
---
monedula-acl-rbac is a single binary with no runtime dependencies. Install it on the machine or CI runner where you run the migration commands.

## Before you start

- For `go install`: Go 1.26 or newer.
- For a release archive: `curl`, `sha256sum` and, to check the signature, [cosign](https://github.com/sigstore/cosign).
- Release archives exist for Linux and macOS on amd64 and arm64, as `.tar.gz` files, and for Windows on amd64, as a `.zip` file.

## Steps

### 1. Get the binary

With Go, build and install it in one command:

```bash
go install github.com/monedula-dev/monedula-acl-rbac-converter/cmd/monedula-acl-rbac@latest
```

`go install` puts the binary in your Go `bin` directory. If you install this way, continue with step 4.

To use a prebuilt binary instead, download the archive for your platform from the [latest release](https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/latest). Archives are named `monedula-acl-rbac_<version>_<os>_<arch>`, for example `monedula-acl-rbac_0.10.0_linux_amd64.tar.gz`. Verify the archive with steps 2 and 3 before you extract it.

### 2. Verify the signed checksums

Each release signs one file, `checksums.txt`, with cosign keyless signing through GitHub OIDC, so there is no public key to manage. The archives are not signed one by one: you trust the checksums file through its signature, then check the archive against it. Fetch the checksums file with its signature and certificate, and verify it:

```bash
# Fetch the checksums + signature + certificate from the release page
VERSION=v0.10.0   # check https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/latest
curl -LO https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/download/$VERSION/checksums.txt
curl -LO https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/download/$VERSION/checksums.txt.sig
curl -LO https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/download/$VERSION/checksums.txt.pem

cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/monedula-dev/monedula-acl-rbac-converter/.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  checksums.txt
```

A successful verification prints `Verified OK`.

### 3. Check the archive against the checksums

`checksums.txt` lists every artifact of the release, so checking the whole file fails on the archives you did not download. Check only the line of your archive:

```bash
# Set ARCHIVE to the file you downloaded (substitute version/os/arch).
ARCHIVE=monedula-acl-rbac_0.10.0_linux_amd64.tar.gz
grep "$ARCHIVE" checksums.txt | sha256sum -c -
# GNU coreutils alternative that skips the artifacts you didn't download:
# sha256sum --ignore-missing -c checksums.txt
```

Each archive also has a Syft SBOM next to it, `<archive>.sbom.json`. The SBOMs are plain files, not signed attestations. To scan one for known vulnerabilities, run `grype sbom:<archive>.sbom.json`.

Then extract the archive and put `monedula-acl-rbac` on your `PATH`.

### 4. Enable shell completion

The CLI generates completion scripts for bash, zsh, fish and PowerShell. Pick your shell:

<Tabs group="completion-shell" labels={['bash', 'zsh', 'fish', 'PowerShell']} label="Shell">

```bash
# bash (per-user)
monedula-acl-rbac completion bash > ~/.local/share/bash-completion/completions/monedula-acl-rbac
```

```bash
# zsh: add to a directory on $fpath
monedula-acl-rbac completion zsh > "${fpath[1]}/_monedula-acl-rbac"
```

```bash
# fish
monedula-acl-rbac completion fish > ~/.config/fish/completions/monedula-acl-rbac.fish
```

```bash
# PowerShell
monedula-acl-rbac completion powershell | Out-String | Invoke-Expression
```

</Tabs>

The bash script needs the `bash-completion` package. Start a new shell for the bash, zsh and fish scripts to take effect; the PowerShell command loads completions into the current session, and adding it to your PowerShell profile loads them in every session. Each `completion` command page, linked from the [CLI overview](/flock/docs/acl-rbac-converter/reference/cli/), lists the other install locations.

## Check it worked

```bash
monedula-acl-rbac --version
```

It prints the version, the commit and the build date, with `unknown` for any of them the build did not record. Then list the commands:

```bash
monedula-acl-rbac --help
```

## Related

- [Your first ACL to RBAC migration](/flock/docs/acl-rbac-converter/tutorials/first-migration/) runs the CLI in a container, with no install at all.
- [Convert ACLs in one command](/flock/docs/acl-rbac-converter/tutorials/one-shot-conversion/) is a first thing to try after installing.