Installation¶
Install the pacto command-line tool (CLI). Use the installer script: it installs pacto and the plugins with one command. The other two ways need Go and suit contributors.
| Method | Installs | pacto version reports |
|---|---|---|
| Installer script | pacto plus both official plugins |
the release you installed |
go install |
pacto only |
dev, with commit and date unknown |
| From source | pacto only |
version, commit and date from your checkout |
To look first, open the live dashboard demo. It runs Pacto in your browser.
Via installer script¶
This puts three programs in /usr/local/bin: pacto, pacto-plugin-schema-infer and pacto-plugin-openapi-infer. The script checks each download's SHA-256 checksum first. If a plugin fails to install, the script warns and still installs pacto.
Pass --version for a specific release: bash -s -- --version v4.0.0. The CLI, the charts and the images each have their own version numbers. See Versions.
If the script cannot find a version (GitHub API rate limit)
The script asks the GitHub API for the latest version. Without a token GitHub allows 60 requests per hour per IP address, so on a shared network it can fail with Failed to fetch latest version. Set GH_TOKEN to any GitHub token and run it again:
Installing without sudo¶
The installer calls sudo to write to /usr/local/bin. To install into your home directory with no sudo at all:
curl -fsSL https://raw.githubusercontent.com/TrianaLab/pacto/main/scripts/get-pacto.sh \
| PACTO_INSTALL_DIR="$HOME/.local/bin" bash -s -- --no-sudo
$HOME/.local/bin must be on your PATH, and the directory must already exist.
Via Go¶
Requires Go 1.27.3 or later. The binary is placed in $GOBIN (typically ~/go/bin).
go install builds report as dev
pacto version prints Pacto: dev and pacto update refuses to run. Use the installer script if you need version metadata.
From source¶
Requires Go 1.27.3 or later, make and git.
make build installs into $GOBIN (typically ~/go/bin) and stamps the version, commit and build date.
Versions¶
Pacto uses three version numbers:
| Version | What it versions | Current major |
|---|---|---|
pactoVersion |
The contract format, set in each pacto.yaml |
"2.0", "2.1", "2.2" and "2.3" |
| Pacto core | The pacto CLI and the Go library github.com/trianalab/pacto/v4 |
4.x |
| Kubernetes integration | The operator, its Helm chart and delivery | 6.x |
The version selector at the top of these docs follows Pacto core.
A contract with pactoVersion: "2.1" needs Pacto core 4.1.0 or later and
operator 6.1.0 or later. A contract with pactoVersion: "2.2" needs Pacto core
4.3.0 or later and operator 6.3.0 or later. A contract with pactoVersion: "2.3"
needs Pacto core 4.4.0 or later and operator 6.4.0 or later. Older releases reject it. The integration's
version compatibility table
lists the current releases.
Verify the installation¶
The first line should match the release you installed, or say dev if you used go install. If it names an older release, an earlier copy is ahead on your PATH: which pacto shows which one won.
Installing the official plugins¶
The two official plugins (pacto-plugin-schema-infer and pacto-plugin-openapi-infer) are separate binaries from the pacto-plugins repository.
| Install method | Plugins |
|---|---|
| Installer script | Installed (best-effort) |
go install |
Not installed |
| From source | Not installed |
Without them, pacto generate schema-infer fails with plugin "schema-infer" not found. To install by hand, download from pacto-plugins releases and put them on your PATH. See Plugins.
Update the CLI¶
This verifies the new binary's SHA-256 before replacing the current one. A go install build cannot use it; re-run go install github.com/trianalab/pacto/v4/cmd/pacto@latest instead.
Uninstall¶
Pacto has no uninstaller. Remove the binaries, then the state they wrote:
# 1. The binaries (adjust the directory if you set PACTO_INSTALL_DIR, or use
# ~/go/bin if you installed with `go install` or `make build`).
sudo rm -f /usr/local/bin/pacto \
/usr/local/bin/pacto-plugin-schema-infer \
/usr/local/bin/pacto-plugin-openapi-infer
# 2. Registry credentials and the update-check timestamp.
rm -rf ~/.config/pacto
# 3. The pulled-bundle cache.
rm -rf ~/.cache/pacto
The last two follow XDG_CONFIG_HOME and XDG_CACHE_HOME where you set them. Removing ~/.config/pacto deletes stored registry credentials; run pacto logout <registry> first if you would rather drop them one registry at a time.
Supply chain: signatures and checksums¶
Check what ships with each release artifact before you rely on a signature:
| Artifact | What ships with it |
|---|---|
ghcr.io/trianalab/pacto/operator |
Cosign signature (keyless) |
ghcr.io/trianalab/pacto/charts/pacto-operator |
Cosign signature (keyless) |
ghcr.io/trianalab/pacto/delivery |
Cosign signature (keyless) |
ghcr.io/trianalab/pacto/dashboard |
Cosign signature (keyless) |
| CLI binaries on the GitHub release | checksums.txt (SHA-256) and an SPDX SBOM. No signature, no provenance attestation. |
ghcr.io/trianalab/pacto/dashboard-contract |
Nothing. Unsigned. |
The demo contract bundles (ghcr.io/trianalab/pacto/<service>) |
Nothing. Unsigned. |
The release workflow signs the three images and the chart with Cosign "keyless" signing: the signature is tied to the GitHub workflow that built the image, so you store no key. Verifying it proves who built it:
cosign verify \
--certificate-identity-regexp '^https://github\.com/TrianaLab/pacto/\.github/workflows/release\.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
ghcr.io/trianalab/pacto/operator:<version>
A successful run prints the certificate subject and the workflow ref it was issued to. Any other output, including no signatures found, means do not deploy it.
For the CLI binaries the check available to you is the checksum:
pacto update performs this check before replacing the binary. checksums.txt proves the download matches what the release published; it does not prove who published it. If your policy requires signed CLI binaries, build from source at the tag instead.
Next: Quickstart.