Installation¶

Install the pacto command-line tool (CLI). Most people should use the installer script: one command, plugins included. The other two ways need Go and suit contributors.

Method	Installs	`pacto version` reports
Installer script	`pacto` plus both official plugins	the release you installed
`go install`	`pacto` only	`dev`, with commit and date `unknown`
From source	`pacto` only	version, commit and date from your checkout

Want to look first? The live dashboard demo runs Pacto in your browser with nothing to install.

Via installer script¶

curl -fsSL https://raw.githubusercontent.com/TrianaLab/pacto/main/scripts/get-pacto.sh | bash

This puts three programs in /usr/local/bin: pacto, pacto-plugin-schema-infer and pacto-plugin-openapi-infer. The script checks each download's SHA-256 checksum first. If a plugin fails to install, the script warns and still installs pacto.

Pass --version for a specific release: bash -s -- --version v3.1.4.

If the script cannot find a version (GitHub API rate limit)

The script asks the GitHub API for the latest version. Without a token GitHub allows 60 requests per hour per IP address, so on a shared network it can fail with Failed to fetch latest version. Set GH_TOKEN to any GitHub token and run it again:

curl -fsSL https://raw.githubusercontent.com/TrianaLab/pacto/main/scripts/get-pacto.sh \
  | GH_TOKEN="$(gh auth token)" bash

Installing without sudo¶

The installer calls sudo to write to /usr/local/bin. To install into your home directory with no sudo at all:

curl -fsSL https://raw.githubusercontent.com/TrianaLab/pacto/main/scripts/get-pacto.sh \
  | PACTO_INSTALL_DIR="$HOME/.local/bin" bash -s -- --no-sudo

$HOME/.local/bin must be on your PATH, and the directory must already exist.

Via Go¶

go install github.com/trianalab/pacto/v4/cmd/pacto@latest

Requires Go 1.26.9 or later. The binary is placed in $GOBIN (typically ~/go/bin).

go install builds report as dev

pacto version prints Pacto: dev and pacto update refuses to run. Use the installer script if you need version metadata.

From source¶

Requires Go 1.26.9 or later, make and git.

git clone https://github.com/TrianaLab/pacto.git
cd pacto
make build

make build installs into $GOBIN (typically ~/go/bin) and stamps the version, commit and build date.

Verify the installation¶

pacto version

The first line should match the release you installed, or say dev if you used go install. If it names an older release, an earlier copy is ahead on your PATH: which pacto shows which one won.

Installing the official plugins¶

The two official plugins (pacto-plugin-schema-infer and pacto-plugin-openapi-infer) are separate binaries from the pacto-plugins repository.

Install method	Plugins
Installer script	Installed (best-effort)
`go install`	Not installed
From source	Not installed

Without them, pacto generate schema-infer fails with plugin "schema-infer" not found. To install by hand, download from pacto-plugins releases and put them on your PATH. See Plugins.

Update the CLI¶

pacto update              # latest release
pacto update v3.1.4       # specific version

This verifies the new binary's SHA-256 before replacing the current one. A go install build cannot use it; re-run go install github.com/trianalab/pacto/v4/cmd/pacto@latest instead.

Uninstall¶

Pacto has no uninstaller. Remove the binaries, then the state they wrote:

# 1. The binaries (adjust the directory if you set PACTO_INSTALL_DIR, or use
#    ~/go/bin if you installed with `go install` or `make build`).
sudo rm -f /usr/local/bin/pacto \
           /usr/local/bin/pacto-plugin-schema-infer \
           /usr/local/bin/pacto-plugin-openapi-infer

# 2. Registry credentials and the update-check timestamp.
rm -rf ~/.config/pacto

# 3. The pulled-bundle cache.
rm -rf ~/.cache/pacto

The last two follow XDG_CONFIG_HOME and XDG_CACHE_HOME where you set them. Removing ~/.config/pacto deletes stored registry credentials; run pacto logout <registry> first if you would rather drop them one registry at a time.

Supply chain: what is signed and what is not¶

Some release artifacts are signed and some are not. Know which before you rely on a signature:

Artifact	What ships with it
`ghcr.io/trianalab/pacto/operator`	Cosign signature (keyless)
`ghcr.io/trianalab/pacto/charts/pacto-operator`	Cosign signature (keyless)
`ghcr.io/trianalab/pacto/dashboard`	Cosign signature (keyless)
CLI binaries on the GitHub release	`checksums.txt` (SHA-256) and an SPDX SBOM. No signature, no provenance attestation.
`ghcr.io/trianalab/pacto/dashboard-contract`	Nothing. Unsigned.
The demo contract bundles (`ghcr.io/trianalab/pacto/<service>`)	Nothing. Unsigned.

The release workflow signs the three images with Cosign "keyless" signing: the signature is tied to the GitHub workflow that built the image, not to a key you must store. Verifying it proves who built it:

cosign verify \
  --certificate-identity-regexp '^https://github\.com/TrianaLab/pacto/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/trianalab/pacto/operator:<version>

A successful run prints the certificate subject and the workflow ref it was issued to. Anything else — including no signatures found — means do not deploy it.

For the CLI binaries the check available to you is the checksum:

shasum -a 256 -c checksums.txt --ignore-missing

pacto update performs this check before replacing the binary. checksums.txt proves the download matches what the release published; it does not prove who published it. If your policy requires signed CLI binaries, build from source at the tag instead.

Next: Quickstart.