Install

Binaries, go install, the git helper, key stores.

secretree is one static binary plus a git remote helper that is the same binary under a second name. There is nothing to run as root and nothing that phones home.

Requirements

Homebrew (macOS and Linux)

brew install --cask andraspalinkas/tap/secretree

The cask installs secretree and links git-remote-secretree next to it. brew upgrade follows releases.

Binaries

Download the archive for your platform from the releases page, verify it, and put secretree somewhere on your PATH:

tar -xzf secretree_*_darwin_arm64.tar.gz
sudo install -m 755 secretree /usr/local/bin/secretree
secretree install-helper --dir /usr/local/bin
secretree version

Verifying a download

checksums.txt lists every archive and is signed in keyless mode with Sigstore: the certificate is bound to this repository's release workflow, so a signature proves the file came out of that workflow and nothing else.

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/andraspalinkas/secretree/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
shasum -a 256 -c --ignore-missing checksums.txt

Each archive also has an SPDX SBOM (*.sbom.json) next to it on the release.

On Windows, unzip and put secretree.exe in a directory on PATH, then run secretree install-helper from a terminal; it copies the executable as git-remote-secretree.exe next to itself.

With Go

go install github.com/andraspalinkas/secretree/cmd/secretree@latest
secretree install-helper

go install puts the binary in $(go env GOPATH)/bin; install-helper links git-remote-secretree next to it. Make sure that directory is on your PATH, otherwise git cannot find the helper.

The git helper

git looks for an executable named git-remote-secretree on PATH whenever it meets a secretree:: remote. secretree install-helper creates it (a symlink, or a copy where symlinks are not available). secretree init and secretree clone run it for you when the helper is missing.

Check it:

$ which git-remote-secretree
/usr/local/bin/git-remote-secretree

If git says fatal: Unable to find remote helper for 'secretree', the directory holding the helper is not on the PATH that git sees. Put the binary in a standard location or run secretree install-helper --dir <a directory on PATH>.

Key stores

Platform Store Notes
macOS login Keychain, service secretree Written through security -i so the secret never appears in a process listing. The first read may show a Keychain prompt; choose "Always allow".
Linux Secret Service via secret-tool (GNOME Keyring, KDE Wallet) Install libsecret-tools (Debian/Ubuntu) or libsecret (Fedora, Arch). Without it, the file store is used.
Windows, other File store %APPDATA%\secretree\keys\<vault-id>.json, or $SECRETREE_HOME/keys when set, mode 0600.

Force a store with SECRETREE_KEYSTORE=keychain, secret-service or file. Tests and throwaway experiments use SECRETREE_KEYSTORE=file with a temporary SECRETREE_HOME so they never touch your real store.

Try it before trusting it

secretree demo

builds a complete example in a temporary directory with a file key store: two devices, a vault, a pull request with a line comment, an AI reviewer as an agent member, CI, a policy-enforced merge, a deploy, a share page, a backup with restore proof, a disaster restore from the recovery kit alone, and a tamper test. It ends with the local UI running on http://127.0.0.1:7391. secretree demo --clean removes everything. Your real key store and no remote host are touched.

Uninstall

Remove the binary and the helper, delete ~/.config/secretree (or $SECRETREE_HOME), and delete the Keychain or Secret Service items whose service is secretree. Repositories keep their configuration under .git/secretree/; delete that directory to forget a vault. The vault itself is just a git repository on your host.

← previousnext →