Install Gatekeeper · Confidential Router

Gatekeeper is one static binary with no runtime dependencies. The same Linux archive runs on glibc and musl.

With the install script

Code examplesmacOS and LinuxWindows
shfrom the console
curl -fsSL https://github.com/Super-Protocol/confidential-router/releases/latest/download/install.sh | sh
PowerShellfrom the console
irm https://github.com/Super-Protocol/confidential-router/releases/latest/download/install.ps1 | iex

The script detects your OS and CPU, downloads the matching archive from the latest release, verifies it against the release checksums, and installs one binary and nothing else. Nobody should paste a one-liner from the internet on trust alone, so read it first; it is published with every release.

releases/latest never resolves to a pre-release, so neither the nightly build nor a release candidate can be installed by accident.

output on Linux, 2026-10-12
$ curl -fsSL https://github.com/Super-Protocol/confidential-router/releases/latest/download/install.sh | shInstalling gatekeeper 0.3.0 (linux/amd64) from gatekeeper-v0.3.0Checksum OKInstalled /home/you/.local/bin/gatekeepergatekeeper 0.3.0 (commit f23d2d6ef30c27785028b6dfc7f3d2f9a86a60a5, built 2026-10-09T11:19:08Z, go1.26.0, linux/amd64)/home/you/.local/bin is not on your PATH. Add it:  export PATH="/home/you/.local/bin:$PATH"

Putting it on this terminal's PATH

On macOS and Linux the installer cannot change the PATH of the shell that called it: it runs in a child process. Add the install directory to the current session before running gatekeeper:

shfrom the console
export PATH="$HOME/.local/bin:$PATH"

Terminals opened afterwards need nothing, and neither does Windows, where iex runs the script in your own session. The console's setup block carries this line for the same reason.

Script options

Each option is a flag or the matching environment variable.

Flag	Variable	Meaning
`--version <v>`	`GATEKEEPER_VERSION`	`0.3.0`, `v0.3.0`, `gatekeeper-v0.3.0`, or `nightly`
`--install-dir <d>`	`GATEKEEPER_INSTALL_DIR`	Default: `/usr/local/bin` if writable, else `~/.local/bin`
`--repo <owner/repo>`	`GATEKEEPER_REPO`	Default: `Super-Protocol/confidential-router`
`--base-url <url>`	`GATEKEEPER_BASE_URL`	Release download root, `https://` or `file://`, for a mirror or an offline copy
`--api-url <url>`	`GATEKEEPER_API_URL`	Default: `https://api.github.com`

GITHUB_TOKEN, if set, authenticates the one API call that resolves latest. On Windows the script installs into %LOCALAPPDATA%\Programs\gatekeeper and adds it to your user PATH.

Exit codes: 0 installed, 1 failed, 2 bad usage, 3 unsupported platform.

By hand

Take an archive and checksums.txt from Releases. Archives are published for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 and windows/amd64.

sh
sha256sum --check --ignore-missing checksums.txttar -xzf gatekeeper_0.3.0_linux_amd64.tar.gzinstall -m 0755 gatekeeper /usr/local/bin/gatekeepergatekeeper version

Check the install

terminal
$ gatekeeper versiongatekeeper 0.3.0 (commit f23d2d6ef30c27785028b6dfc7f3d2f9a86a60a5, built 2026-10-09T11:19:08Z, go1.26.0, linux/amd64)

Next: Connect Gatekeeper to the router.