Install Korva

Install the Korva CLI and Vault server on macOS, Linux or Windows in 30 seconds. Three options — curl installer, Homebrew tap, or Docker — all verified against signed checksums.

Updated: 2026-04-30

Korva ships as three single-file binaries: korva (CLI), korva-vault (the local server) and korva-sentinel (the pre-commit validator). They are pure Go (no CGO), so the install is the same on every platform — drop the binaries somewhere on your $PATH and you’re done.

Option 1: curl installer (macOS / Linux)

curl -fsSL https://korva.dev/install | bash

The script detects your OS and architecture, downloads the matching tarball from the latest GitHub release, verifies the SHA256 checksum, and installs the three binaries to:

$KORVA_INSTALL_DIR if you set it explicitly, or
/usr/local/bin if writable, or
~/.local/bin (created if missing).

It warns you if the install directory is not on your $PATH and suggests the right shell config line.

To pin a specific version:

KORVA_VERSION=v1.0.0 curl -fsSL https://korva.dev/install | bash

To install only the CLI without the vault server (useful in CI):

KORVA_NO_VAULT=yes curl -fsSL https://korva.dev/install | bash

Option 2: Homebrew (macOS / Linux)

brew install alcandev/tap/korva

The tap is updated automatically by every release. Updates land via brew upgrade korva.

Option 3: PowerShell (Windows)

Run PowerShell as Administrator (so the script can update system PATH):

irm https://korva.dev/install.ps1 | iex

The script downloads the matching .zip, extracts the three .exe binaries to %LOCALAPPDATA%\korva\bin\, and updates your user PATH (system PATH if elevated). On systems where korva.exe is currently in use, the new binary is staged with a .new extension and renamed on next start.

Option 4: Docker (self-hosted vault)

docker pull ghcr.io/alcandev/korva-vault:latest
docker compose up -d vault

This runs only the vault server (port 7437). For the developer machine you still want the local korva CLI to talk to it. See Self-hosting for the full Compose stack with Traefik for HTTPS.

Verifying the install

korva --version
korva doctor

korva doctor runs 13+ checks: home dir, config, binaries on PATH, vault reachable, install.id, hive.key, license, admin.key (if present), git available, vault DB exists, project config, license heartbeat. Every line should show ✓ or a clear remediation.

Where things land

Path	What
`~/.korva/` (Unix) / `%LOCALAPPDATA%\korva\` (Windows)	Global state
`~/.korva/vault/observations.db`	The local SQLite vault
`~/.korva/admin.key`	Admin credential (mode `0600`, only if `--admin`)
`~/.korva/hive.key`	Optional Hive sync API key (mode `0600`)
`~/.korva/install.id`	Stable installation ID, never rotated
`<project>/korva.config.json`	Per-project config (created by `korva init`)

Nothing is sent over the network during install other than the GitHub release download itself. There is no telemetry.