Install

Burrowee ships three installable components, each with its own one-line installer on the public release channel at release.burrowee.com. Every download is verified end-to-end before a single byte runs: minisign signature → SHA-256 checksum → unzip → a verified inner installer.

Component	One-liner	Binaries installed
CLI — the client you connect from	curl -fsSL --proto '=https' --tlsv1.2 https://release.burrowee.com/cli/install.sh | sh	burrowee, burrowee-cli, burrowee-cli-updater
Gateway — the machine you connect to	curl -fsSL --proto '=https' --tlsv1.2 https://release.burrowee.com/gateway/install.sh | sh	burrowee, burrowee-gateway, burrowee-gateway-cli, burrowee-gateway-console, burrowee-register, burrowee-gateway-updater
Edge — your own self-hosted relay	curl -fsSL --proto '=https' --tlsv1.2 https://release.burrowee.com/edge/install.sh | sh	burrowee, burrowee-edge, burrowee-edge-cli, burrowee-edge-updater

Each component bundles the burrowee dispatcher (see below), so after any one install the bare burrowee command works. Per-component walkthroughs: CLI · Gateway · Edge.

Burrowee also has a relay component — the shared relay fleet Burrowee operates for you — but it has no public installer; you never install it yourself. See What is Burrowee for what it does.

What the installer does

The install.sh you pipe to sh is the trust anchor. It never runs an unverified byte:

1. Detects your platform — macOS (darwin) or Linux, arm64 or amd64. Anything else aborts.
2. Preflight — installs any missing OS dependencies (minisign, unzip, curl, ca-certificates; plus nginx and its stream module for edge) via your package manager, using root if available. Non-fatal on its own — the verification steps below are the real backstop. Skip it with BURROWEE_SKIP_PREFLIGHT=1 (edge: BURROWEE_SKIP_NGINX=1 to skip only the nginx group).
3. Resolves the release — the latest published GitHub release for that component, unless you pin a version.
4. Downloads the release zip plus SHA256SUMS.txt and SHA256SUMS.txt.minisig, logging the exact URL of every attempt. See If GitHub is unreachable for what happens when the primary download fails.
5. Verifies the minisign signature over the sums file, against a public key baked into the installer itself — no key is fetched over the network.
6. Verifies the zip's SHA-256 against the now-trusted sums file.
7. Unzips and runs the inner installer, which installs the binaries to $PREFIX/bin — by default $HOME/.local/bin.

Any failure at any step aborts before anything is installed.

Once the inner installer finishes, the outer script checks whether the bin directory is on your PATH. If not, it appends an export PATH=… block to your shell's rc file (~/.bashrc plus your login profile, or ~/.zshrc plus ~/.zprofile for zsh) so a fresh shell picks it up automatically — set BURROWEE_NO_PATH_EDIT=1 to skip this and manage PATH yourself. On a fresh interactive install it also offers to set the component up immediately — see the per-component pages for that first-run prompt.

Prerequisites

The installer needs curl, unzip, a SHA-256 tool (shasum on macOS or sha256sum on Linux — it detects either), and minisign. The preflight step above tries to install these for you automatically; the warning below is what you'll see if that isn't possible (no supported package manager, no root, offline, …).

minisign is required — and never auto-fetched

minisign is the trust root: it must already be on PATH from a source you trust (your package manager). The installer refuses to download a verifier over the network itself, because an unverified verifier would defeat the whole signature chain. If it is missing, install it and re-run:

brew install minisign          # macOS — installs Homebrew first if needed:
                                # /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
apt-get install minisign       # Debian/Ubuntu (or your distro's package manager)

Upstream: https://github.com/jedisct1/minisign

Verify by hand

The signing public key is mirrored at https://release.burrowee.com/burrowee-release.pub. To verify a release download yourself:

minisign -V -P "$(cat burrowee-release.pub)" \
  -m SHA256SUMS.txt -x SHA256SUMS.txt.minisig
shasum -a 256 -c --ignore-missing SHA256SUMS.txt   # or sha256sum on Linux

A failed signature check means the bytes are untrusted — do not install them.

If GitHub is unreachable

Every download is logged — the exact URL of each attempt is printed as it happens — so a stalled or blocked network is easy to diagnose. The primary GitHub download gets a tight 30-second cap; if it fails, the installer retries the same download through a rotating set of GitHub HTTP mirrors (gh-proxy.org, cdn.gh-proxy.org, v6.gh-proxy.org, gh-proxy.com by default) before giving up. Set BURROWEE_GH_PROXY="<mirror> <mirror> …" to use your own list, or BURROWEE_GH_PROXY= (empty) to disable mirrors entirely. Mirrored bytes still go through the same minisign + SHA-256 verification, so a compromised mirror can't slip in tampered bytes undetected.

If GitHub and every mirror are unreachable, and this machine already has an authorized burrowee (see burrowee login), the installer falls back to a signed download URL from the console instead. Without an authorized burrowee on the machine, that fallback isn't available and the installer fails with a clear message — retry once GitHub or a mirror is reachable.

Supported platforms

OS	arm64	amd64
macOS (darwin)	✓	✓
Linux	✓	✓

Windows is not supported.

The burrowee dispatcher

Every component zip ships burrowee — the universal entry command. It is a near-zero-logic dispatcher: burrowee <component> … finds the installed binary for that component (on PATH, then /usr/local/bin, /opt/homebrew/bin, ~/.local/bin) and replaces itself with it. Anything that isn't a component word falls through to the CLI untouched, so burrowee connect … runs burrowee-cli connect ….

Word	Runs	What it is
cli	burrowee-cli	client tunnels (connect, ssh, daemon, relays) — also the fallthrough default
gateway	burrowee-gateway	the home gateway daemon + local console
relay	burrowee-relay	the system relay server
edge	burrowee-edge	self-hosted edge relay
console	burrowee-console	the cloud control plane server
register	burrowee-register	register a local service with the gateway

Gateway and edge each split into a serving binary (the daemon — just run/update/version) and a -cli companion that handles every other verb, including bootstrap, status, doctor, …. The dispatcher routes each verb to the right binary automatically, so burrowee gateway bootstrap … and burrowee gateway status both just work; burrowee <component> cli … also reaches the companion explicitly if you ever need to (e.g. burrowee edge cli doctor, which is the same as burrowee-edge-cli doctor).

burrowee --help prints this component table; burrowee <component> --help shows that component's commands. Asking for a component that isn't installed on the machine exits with code 127 and prints which components are installed there, plus where to install the missing one. (Exit 126 means the binary was found but could not be executed.)

burrowee version (or --version) prints just the dispatcher's own version. burrowee <component> version prints that component's. burrowee cli version goes further and prints a small versions table — the dispatcher plus the cli's installed-vs-currently-running state, flagging drift — handy right after an install or update to confirm everything landed.

Pin a version

Each installer reads a version-pin env var; the value is the release tag (<comp>/<stamp>):

Component	Env var
cli	BURROWEE_CLI_VERSION
gateway	BURROWEE_GATEWAY_VERSION
edge	BURROWEE_EDGE_VERSION

BURROWEE_CLI_VERSION=cli/v0.1.0.2026.06.08.7dbdd72 \
  curl -fsSL https://release.burrowee.com/cli/install.sh | sh

Unset → the installer resolves the newest release for that component.

Choose the install location

Set PREFIX to change the install root (binaries go to PREFIX/bin; the default is $HOME/.local, i.e. binaries in ~/.local/bin):

PREFIX=/usr/local curl -fsSL --proto '=https' --tlsv1.2 https://release.burrowee.com/cli/install.sh | sh

To uninstall a component's binaries, re-run its installer with BURROWEE_UNINSTALL=1.

macOS notes

Gatekeeper & code signing

Every release is verified before anything runs — the installer checks a minisign signature over SHA256SUMS.txt and the SHA-256 of the downloaded zip (see Verify by hand). The macOS binaries themselves are ad-hoc signed, not Developer ID signed or notarized — but since they arrive via curl | sh rather than a browser download, macOS never attaches the com.apple.quarantine attribute in the first place, so Gatekeeper has nothing to block. The installer also strips the attribute defensively, in case a binary reaches you by another route (a manual download, a build you made yourself). If you ever move a binary onto PATH by hand and macOS refuses to run it, remove the attribute yourself:

xattr -d com.apple.quarantine ~/.local/bin/burrowee-cli