loot

Install

Get loot

One command. The installer detects your platform, downloads the release archive from dl.millerbyte.com, unpacks it to ~/.loot/bin, and puts it on your PATH.

curl -sSf https://loot.millerbyte.com/install.sh | sh

Then open a fresh shell and run loot --version — it should print loot 0.4.2. Re-running the installer is idempotent.

All platforms

Prebuilt binaries for the v0.4.2 release, served from dl.millerbyte.com. Download and unpack manually if you'd rather not pipe a script.

PlatformDownload
macOS (Apple Silicon)loot-cli-aarch64-apple-darwin.tar.xz
macOS (Intel)loot-cli-x86_64-apple-darwin.tar.xz
Windows (x64)loot-cli-x86_64-pc-windows-msvc.zip
Windows (ARM64)loot-cli-aarch64-pc-windows-msvc.zip
Linux (x64, gnu)loot-cli-x86_64-unknown-linux-gnu.tar.xz
Linux (ARM64, gnu)loot-cli-aarch64-unknown-linux-gnu.tar.xz

Verify your download

Every release publishes a unified sha256.sum beside the archives. Hash what you downloaded, compare it against that file. This is an integrity check, not a provenance one — the difference is spelled out below, and it is the whole of what loot offers.

Checksum

Hash the archive and compare it against the published sum.

# Windows (PowerShell)
Get-FileHash .\loot-cli-x86_64-pc-windows-msvc.zip -Algorithm SHA256
# macOS / Linux
shasum -a 256 loot-cli-x86_64-unknown-linux-gnu.tar.xz

# ...then confirm the hash is the line for that file in:
curl -sSfL https://dl.millerbyte.com/v0.4.2/sha256.sum

The hashes in sha256.sum are lowercase; Get-FileHash prints uppercase. Compare case-insensitively. Each archive also has its own .sha256 file at the same base if you'd rather fetch one line than the whole set.

What the checksum proves — and what it does not

A matching hash proves the bytes on your disk are the bytes this release published, intact and unmodified in transit. That is worth checking and it is a real guarantee.

It does not prove who built them. The archive and sha256.sum ship from the same place, so anyone able to substitute one could substitute the other. A checksum is a statement about bytes, not about origin.

There is no provenance check to run, and that is a decision, not a gap. GitHub Artifact Attestations — the usual answer — are unavailable on user-owned private repositories, and loot builds in one. That is a settled choice, not a temporary state, so attestations are not pending: they are out, and SHA-256 is the integrity story on purpose. An earlier version of this page documented a gh attestation verify command. It could never have succeeded here, and it has been removed rather than left to fail.

Where the bytes actually come from. Both halves of the one-liner are served by infrastructure this project controls, and neither is GitHub. loot.millerbyte.com serves the install script: the release's own cargo-dist installer, re-served with its download list rewritten to put dl.millerbyte.com first. The script then fetches the archive from dl.millerbyte.com — Cloudflare R2, where release CI mirrors every asset. The private GitHub Release stays in the list behind it as a fallback, but only a credentialed fetch can use it.

The one-liner is protected by TLS and nothing else — neither installer carries an embedded checksum, by design, which is how uv and the other cargo-dist tools ship. TLS covers the transport; nothing in the automated path speaks to who built the bytes. For defense in depth, download manually from the table above and run the checksum.

Build from source

loot is a Rust workspace. Building yourself needs a Rust toolchain; the binary is loot in the loot-cli crate.

cargo install --git https://github.com/Connor-Miller/loot loot-cli

loot is not published to crates.io, so the --git form above is the only cargo route — and it needs read access to the source repository, which is not public today. Without that access this command cannot resolve, and the prebuilt archives above are the way in. The hosted one-liner at the top of this page is the supported path.

Troubleshooting

  • loot not found after install — the installer prepends ~/.loot/bin to your PATH (via the user registry on Windows). Open a fresh shell so the change is picked up.
  • Confirm the version — loot --version prints the binary's self-reported version; a versioned release and the binary can't drift.
  • Manual install — grab the archive for your platform from the all-platforms table above, unpack it, and put the loot binary anywhere on your PATH. Those links point at dl.millerbyte.com, which serves anonymously; the GitHub releases page does not.