Installation

Quick install (Linux / macOS)

curl -fsSL https://raw.githubusercontent.com/antstanley/oidc-exchange/main/install.sh | bash

The installer verifies the downloaded binary’s checksum and, when the GitHub CLI (gh) is available, requires GitHub build provenance from antstanley/oidc-exchange and .github/workflows/release.yml. Without gh, it prints an explicit warning and proceeds with checksum-only corruption detection; the artifact is not authenticated.

To install a specific version:

curl -fsSL https://raw.githubusercontent.com/antstanley/oidc-exchange/main/install.sh | bash -s -- --version v0.4.0

Docker

docker pull ghcr.io/antstanley/oidc-exchange:latest

Or from Docker Hub:

docker pull antstanley80/oidc-exchange:latest

Run with a config file:

docker run -p 8080:8080 -v ./config:/app/config ghcr.io/antstanley/oidc-exchange:latest

Node.js

npm install @oidc-exchange/node

See the Node.js guide for framework-specific setup.

Python

pip install oidc-exchange

See the Python guide for framework-specific setup.

Prebuilt binaries

Download from GitHub Releases:

Platform	Binary
Linux x86_64	oidc-exchange-linux-x64
Linux ARM64	oidc-exchange-linux-arm64
macOS ARM64	oidc-exchange-darwin-arm64
Windows x86_64	oidc-exchange-windows-x64.exe

From source

Requires a recent stable Rust toolchain (CI builds and tests on rustc 1.98):

git clone https://github.com/antstanley/oidc-exchange.git
cd oidc-exchange
cargo build --release

The binary is at target/release/oidc-exchange.

When GitHub CLI is unavailable, the installer reports whether checksum verification actually succeeded. If checksum tooling is also unavailable (neither sha256sum nor shasum is present), the installer aborts before downloading anything rather than installing an unverified binary. Whenever gh is present, provenance failure aborts installation.