Install monedula-acl-rbac

monedula-acl-rbac is a single binary with no runtime dependencies. Install it on the machine or CI runner where you run the migration commands.

Before you start

• For go install: Go 1.26 or newer.
• For a release archive: curl, sha256sum and, to check the signature, cosign.
• Release archives exist for Linux and macOS on amd64 and arm64, as .tar.gz files, and for Windows on amd64, as a .zip file.

Steps

1. Get the binary

With Go, build and install it in one command:

go install github.com/monedula-dev/monedula-acl-rbac-converter/cmd/monedula-acl-rbac@latest

go install puts the binary in your Go bin directory. If you install this way, continue with step 4.

To use a prebuilt binary instead, download the archive for your platform from the latest release. Archives are named monedula-acl-rbac_<version>_<os>_<arch>, for example monedula-acl-rbac_0.10.0_linux_amd64.tar.gz. Verify the archive with steps 2 and 3 before you extract it.

2. Verify the signed checksums

Each release signs one file, checksums.txt, with cosign keyless signing through GitHub OIDC, so there is no public key to manage. The archives are not signed one by one: you trust the checksums file through its signature, then check the archive against it. Fetch the checksums file with its signature and certificate, and verify it:

# Fetch the checksums + signature + certificate from the release page
VERSION=v0.10.0   # check https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/latest
curl -LO https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/download/$VERSION/checksums.txt
curl -LO https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/download/$VERSION/checksums.txt.sig
curl -LO https://github.com/monedula-dev/monedula-acl-rbac-converter/releases/download/$VERSION/checksums.txt.pem

cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/monedula-dev/monedula-acl-rbac-converter/.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  checksums.txt

A successful verification prints Verified OK.

3. Check the archive against the checksums

checksums.txt lists every artifact of the release, so checking the whole file fails on the archives you did not download. Check only the line of your archive:

# Set ARCHIVE to the file you downloaded (substitute version/os/arch).
ARCHIVE=monedula-acl-rbac_0.10.0_linux_amd64.tar.gz
grep "$ARCHIVE" checksums.txt | sha256sum -c -
# GNU coreutils alternative that skips the artifacts you didn't download:
# sha256sum --ignore-missing -c checksums.txt

Each archive also has a Syft SBOM next to it, <archive>.sbom.json. The SBOMs are plain files, not signed attestations. To scan one for known vulnerabilities, run grype sbom:<archive>.sbom.json.

Then extract the archive and put monedula-acl-rbac on your PATH.

4. Enable shell completion

The CLI generates completion scripts for bash, zsh, fish and PowerShell. Pick your shell:

# bash (per-user)
monedula-acl-rbac completion bash > ~/.local/share/bash-completion/completions/monedula-acl-rbac

# zsh: add to a directory on $fpath
monedula-acl-rbac completion zsh > "${fpath[1]}/_monedula-acl-rbac"

# fish
monedula-acl-rbac completion fish > ~/.config/fish/completions/monedula-acl-rbac.fish

# PowerShell
monedula-acl-rbac completion powershell | Out-String | Invoke-Expression

The bash script needs the bash-completion package. Start a new shell for the bash, zsh and fish scripts to take effect; the PowerShell command loads completions into the current session, and adding it to your PowerShell profile loads them in every session. Each completion command page, linked from the CLI overview, lists the other install locations.

Check it worked

monedula-acl-rbac --version

It prints the version, the commit and the build date, with unknown for any of them the build did not record. Then list the commands:

monedula-acl-rbac --help

Related

• Your first ACL to RBAC migration runs the CLI in a container, with no install at all.
• Convert ACLs in one command is a first thing to try after installing.