Documentation
Install kit, make a signed commit, and verify an attestation.
Install
The installer downloads the release archive for your platform. It verifies the cosign signature of the archive, then the SHA256 sum. It installs kit into ~/.local/bin.
$ curl -sSfL https://kit.storage/install.sh | shThe installer stops if cosign is not in your PATH. To read the script before you run it, open /install.sh. To pin a version, pass --version:
$ curl -sSfL https://kit.storage/install.sh | sh -s -- --version v0.5.0kit supports Linux and macOS. On Windows, run kit under WSL. The Linux archives need glibc 2.39 or newer. To build from source, use Rust 1.99 or newer:
$ cargo install --git https://github.com/officialunofficial/kit kit-binMake a signed commit
kit init creates a .kit/ directory. kit keygen makes an Ed25519 signing key. Every commit carries a signature from that key.
$ kit init$ kit keygen$ echo hello > hi.txt$ kit add hi.txt$ kit commit -m "first commit"$ kit logShare a commit
Add a remote and push. The URL scheme picks the transport.
$ kit remote add origin kit+file:///srv/kit/my-repo$ kit push originAttest to a commit
An attestation is a signed statement about a commit. kit verify-attest trusts only the keys in your user-level trust-roots file. Add your own key to it, then verify:
$ kit attest --predicate-type https://example.com/sign-off/v1$ kit keygen --print-pubkey$ kit trust add ed25519:<hex> <hex>$ kit verify-attestkit keygen --print-pubkey prints ed25519:<hex>. Use that value in kit trust add.
Use kit with a coding agent
SKILL.md lists the commands that an agent needs and the points where kit differs from Git.
More documentation
INSTALL.mdInstall channels, verification and updates.CLI.mdEvery subcommand, config key and exit code.GUIDE-GIT-WORKFLOWS.mdGit users and Git upstreams.VERIFY.mdVerify a commit hash without access to the repository.ARCHITECTURE.mdThe crate layout.THREAT-MODEL.mdThe security boundaries.