Install and update the OriginChainDB CLI

Release availability

The installed Windows development preview remains 0.6.0-dev.20261020. Its executable and checksum-verified installer have been exercised. The preview delivery contains originchaindb-cli-0.6.0-dev.20261020-windows-amd64.zip, install.py and SHA256SUMS. Obtain those files from your approved delivery; this documentation page does not provide a public preview binary.

The download channel was provisioned for future releases. Stable executable and signed-manifest publication remains an open release gate. Documentation publication does not make the CLI generally available.

Target	v0.6 runtime evidence	Release availability
Windows x64	Native runtime, Credential Manager, installer and signed-updater checks pass	Local development preview; stable unpublished
Linux x64	Native runtime under WSL2, Secret Service, installer and signed-updater checks pass	Verified local candidate; stable unpublished
Linux ARM64	Native ARM64 runtime, Secret Service, installer and signed-updater checks pass	Verified local candidate; stable unpublished
Intel macOS	Native runtime, Keychain, installer and signed-updater checks pass	Verified local candidate; stable unpublished
Apple Silicon macOS	Native runtime, Keychain, installer and signed-updater checks pass	Verified local candidate; stable unpublished

The 21 October checkpoint includes checksum-verified local candidates for all five targets. Signed-updater tests use temporary test keys and disposable copies; they do not establish a published production signature or public update channel. There is no Windows ARM64 package, package-manager distribution or universal Mac binary in this preview. See Tests and release status for the precise evidence.

Install an approved archive

Obtain the package, install.py, and its trusted SHA-256 digest from your approved preview delivery or a future official release. Do not use a checksum from an unrelated download site. Python 3.9 or newer is required for the installer.

Windows:

python install.py --archive originchaindb-cli-0.6.0-dev.20261020-windows-amd64.zip --sha256 TRUSTED_SHA256

For an approved Linux x64 archive:

python3 install.py --archive oc_VERSION_linux_amd64.tar.gz --sha256 TRUSTED_SHA256

For an approved Intel Mac archive:

python3 install.py --archive oc_VERSION_darwin_amd64.tar.gz --sha256 TRUSTED_SHA256

Replace VERSION and TRUSTED_SHA256 with the actual approved delivery values. Use arm64 in the archive name for Linux ARM64 or Apple Silicon. These commands describe verified installer interfaces; public stable packages remain unpublished.

The installer checks the archive hash before writing, extracts only the bounded executable entry, verifies that the executable runs on your platform, and retains a previous binary when replacing it. It does not require administrator privileges. To choose an isolated directory:

python3 install.py --archive PACKAGE --sha256 TRUSTED_SHA256 --directory INSTALL_DIRECTORY --no-path

Use python in the Windows equivalent. Paths containing spaces must be quoted.

PATH and first run

Windows installs into a user-local bin directory under %LOCALAPPDATA%, prints the exact executable path, and adds that directory to user PATH unless --no-path is used. Open a new terminal before running oc.

On Unix, follow the exact PATH line printed by the installer for your chosen directory and shell. You can also invoke the executable by its full path. Load completion separately; installing the binary does not modify shell completion files.

oc version
oc help
oc ui

Continue with the end-to-end guide. Configuration and credential storage are separate from the installation directory.

Credential-store prerequisites

OS	Store	Requirement
Windows	Credential Manager	Your normal user session
macOS	Keychain	An available, unlocked user Keychain
Linux	Secret Service	secret-tool and an unlocked Secret Service session

On Debian/Ubuntu, secret-tool is supplied by libsecret-tools; use your distribution’s equivalent elsewhere. Installing the helper alone does not start or unlock a Secret Service. A locked or absent store causes an error rather than plaintext fallback. Headless automation can use environment credentials instead.

Administrative login prerequisites

Engine queries and the terminal menu can be used with an existing engine profile. Console identity, database discovery and organization management require the paired backend/console deployment. Roles, permissions and team commands additionally require migration 0110_cli_organization_admin.sql and a new token explicitly approved with org:admin. Existing databases:read tokens stay read-only. See the administration walkthrough.

Verified updates

These commands apply after a signed manifest and binaries are published. They become usable when the release gates are complete and the stable channel contains a signed release:

oc update --manifest https://downloads.originchain.ai/cli/stable.json --public-key TRUSTED_ED25519_PUBLIC_KEY --check
oc update --manifest https://downloads.originchain.ai/cli/stable.json --public-key TRUSTED_ED25519_PUBLIC_KEY

The provisioned publisher public key is:

c12f26e2f4b85d0a1f3dd3a033f45b95856cf2533469e79cc9b74b632790ea6c

Confirm the trust key through your approved release record or independently trusted publisher documentation. Do not trust a new key merely because an unsigned manifest includes it. The published key file contains the same public value. It is not a secret.

The current preview requires --public-key; reviewed release builds can embed the key. The updater requires a valid Ed25519 signature, unexpired manifest, newer version, one matching OS/architecture artifact, expected byte length and SHA-256. HTTPS is mandatory outside loopback tests, and redirects are refused. --check verifies availability without installing. Concurrent updates are prevented with a lock file.

Recovery and removal

An update retains the previous executable and returns its path in the result. On Unix, replacement is atomic. Windows stages and renames the executable, attempting rollback when replacement reports an error. A crash between Windows renames may require manually restoring the retained .previous executable.

Close other CLI processes, preserve the backup, and restore it to the original executable path if needed. Run oc version afterward. Do not delete an update lock until you have confirmed that no update process is active. The updater refuses downgrades; recovery is an explicit manual action.

For uninstalling, first remove stored credentials and profiles you no longer need, then remove only the installed binary, its known recovery files, and an unused PATH entry. Uninstalling does not revoke remote tokens or delete a database.

Build from source

Authorized repository users can build the CLI with Go 1.23 or newer; this preview was validated with Go 1.26.2. The Go client has no third-party Go dependencies. From its source checkout:

go build -o oc ./cmd/oc
./oc help

On Windows, use go build -o oc.exe ./cmd/oc and ./oc.exe help. A source build is not an official signed release. Release packaging requires a clean checkout, Python 3.10+, explicit versioning, and the publisher’s public key. See the repository’s RELEASING.md for maintainer instructions.