Install the Gateway

Install the verdictan CLI. Then, verify the local environment and create a working gateway setup.

Regional installers

Use the regional installer for a guided installation from the selected regional release host.

Region	macOS and Linux	Windows PowerShell	Release base
EU	https://get.eu.verdictan.com/install.sh	https://get.eu.verdictan.com/install.ps1	https://dl.eu.verdictan.com/releases/latest
US	https://get.us.verdictan.com/install.sh	https://get.us.verdictan.com/install.ps1	https://dl.us.verdictan.com/releases/latest

macOS or Linux

Download the regional installer. Examine it. Then, run the local copy:

INSTALLER="$(mktemp)"
curl -fsSL https://get.eu.verdictan.com/install.sh -o "$INSTALLER"
less "$INSTALLER"
sh "$INSTALLER"
rm "$INSTALLER"

The hosted installer downloads the platform binary and its published SHA-256 file from the same regional release base. The file must contain a complete 64-digit hexadecimal digest. It rejects malformed metadata and checksum mismatches. It installs verdictan and tries to register a background gateway service.

The x86_64 and amd64 values select the amd64 artifact. The arm64 and aarch64 values select the arm64 artifact. On macOS, the service is a LaunchDaemon or LaunchAgent. On Linux, it is a systemd service. Systemd and the necessary privileges must be available.

Regional installers use only their dl.<region>.verdictan.com release bucket. They stop if that bucket is not available. They do not change regions.

Install only the binary without background-service setup:

INSTALLER="$(mktemp)"
curl -fsSL https://get.eu.verdictan.com/install.sh -o "$INSTALLER"
less "$INSTALLER"
sh "$INSTALLER" --no-service
rm "$INSTALLER"

For a Linux service installation, the installer writes runtime environment values to /etc/verdictan/verdictan.env. These values include VERDICTAN_API_URL, VERDICTAN_API_TOKEN, and the optional agent selector. The verdictan-gateway systemd unit loads this file. Shell metacharacters stay literal. On macOS and Linux, the installer rejects control characters in service environment values. Newline characters are control characters.

Windows

$installer = Join-Path $env:TEMP "verdictan-install.ps1"
Invoke-WebRequest -Uri "https://get.eu.verdictan.com/install.ps1" -OutFile $installer
Get-Content $installer
powershell.exe -ExecutionPolicy Bypass -File $installer
Remove-Item $installer

The PowerShell installer downloads the Windows binary and its SHA-256 file from the selected region. It stops if the hashes are different.

Direct downloads

Select one regional release base before downloading artifacts. Direct downloads do not switch regions automatically.

macOS

brew install verdictan/tap/verdictan

Or download the active disk image directly:

RELEASE_BASE="https://dl.eu.verdictan.com/releases/latest" # or https://dl.us.verdictan.com/releases/latest
curl -fsSLO "${RELEASE_BASE}/verdictan-macos-universal.dmg"
EXPECTED_SHA256="$(curl -fsSL "${RELEASE_BASE}/manifest.json" | jq -r '.artifacts[] | select(.filename == "verdictan-macos-universal.dmg") | .sha256')"
ACTUAL_SHA256="$(shasum -a 256 verdictan-macos-universal.dmg | awk '{print $1}')"
test -n "$EXPECTED_SHA256" && test "$EXPECTED_SHA256" != "null" && test "$ACTUAL_SHA256" = "$EXPECTED_SHA256"
hdiutil attach verdictan-macos-universal.dmg
cp /Volumes/Verdictan\ Gateway/verdictan /usr/local/bin/verdictan
hdiutil detach /Volumes/Verdictan\ Gateway

Linux (x86_64)

RELEASE_BASE="https://dl.eu.verdictan.com/releases/latest" # or https://dl.us.verdictan.com/releases/latest
curl -fsSLO "${RELEASE_BASE}/verdictan-linux-x86_64.deb"
EXPECTED_SHA256="$(curl -fsSL "${RELEASE_BASE}/manifest.json" | jq -r '.artifacts[] | select(.filename == "verdictan-linux-x86_64.deb") | .sha256')"
ACTUAL_SHA256="$(sha256sum verdictan-linux-x86_64.deb | awk '{print $1}')"
test -n "$EXPECTED_SHA256" && test "$EXPECTED_SHA256" != "null" && test "$ACTUAL_SHA256" = "$EXPECTED_SHA256"
sudo dpkg -i verdictan-linux-x86_64.deb

Or use the RPM package:

RELEASE_BASE="https://dl.eu.verdictan.com/releases/latest" # or https://dl.us.verdictan.com/releases/latest
curl -fsSLO "${RELEASE_BASE}/verdictan-linux-x86_64.rpm"
EXPECTED_SHA256="$(curl -fsSL "${RELEASE_BASE}/manifest.json" | jq -r '.artifacts[] | select(.filename == "verdictan-linux-x86_64.rpm") | .sha256')"
ACTUAL_SHA256="$(sha256sum verdictan-linux-x86_64.rpm | awk '{print $1}')"
test -n "$EXPECTED_SHA256" && test "$EXPECTED_SHA256" != "null" && test "$ACTUAL_SHA256" = "$EXPECTED_SHA256"
sudo rpm -i verdictan-linux-x86_64.rpm

Linux (ARM64)

RELEASE_BASE="https://dl.eu.verdictan.com/releases/latest" # or https://dl.us.verdictan.com/releases/latest
curl -fsSLO "${RELEASE_BASE}/verdictan-linux-aarch64.tar.gz"
EXPECTED_SHA256="$(curl -fsSL "${RELEASE_BASE}/manifest.json" | jq -r '.artifacts[] | select(.filename == "verdictan-linux-aarch64.tar.gz") | .sha256')"
ACTUAL_SHA256="$(sha256sum verdictan-linux-aarch64.tar.gz | awk '{print $1}')"
test -n "$EXPECTED_SHA256" && test "$EXPECTED_SHA256" != "null" && test "$ACTUAL_SHA256" = "$EXPECTED_SHA256"
sudo tar xzf verdictan-linux-aarch64.tar.gz -C /usr/local/bin verdictan
rm verdictan-linux-aarch64.tar.gz

Windows

$releaseBase = "https://dl.eu.verdictan.com/releases/latest" # or https://dl.us.verdictan.com/releases/latest
Invoke-WebRequest -Uri "$releaseBase/verdictan-windows-x86_64.zip" -OutFile verdictan-windows-x86_64.zip
$manifest = Invoke-RestMethod -Uri "$releaseBase/manifest.json"
$expected = ($manifest.artifacts | Where-Object filename -eq "verdictan-windows-x86_64.zip").sha256
$actual = (Get-FileHash verdictan-windows-x86_64.zip -Algorithm SHA256).Hash.ToLower()
if (-not $expected -or $actual -ne $expected) { throw "Verdictan archive checksum mismatch" }
Expand-Archive verdictan-windows-x86_64.zip -DestinationPath "$env:LOCALAPPDATA\verdictan"
$env:PATH += ";$env:LOCALAPPDATA\verdictan"

Docker

docker pull verdictan/verdictan:latest
docker run --rm verdictan/verdictan:latest --version

The container image contains the same verdictan command. Follow the Quickstart. Mount its policy-config.yaml when you start the gateway. An unconfigured container is not a governed deployment.

The shell checksum examples use jq. Install jq before you use the direct download method. A missing manifest entry, an empty manifest hash, or a mismatch must stop the installation. The regional installer does its own binary checksum check. It is the simpler verified method.

Verify the install

verdictan --version
verdictan doctor

verdictan doctor shows that the binary runs. It also reports each missing prerequisite.

Create a starter project

verdictan init

This command creates a starter policy-config.yaml and sample tests. Then, continue to Quickstart.

Next steps

1. Follow Quickstart to create a minimal governed config and send a first request.
2. Read Config-First Workflow if you want the recommended operating model before rollout.
3. Read the CLI Overview for the available command groups and workflows.