1. The one-liner

curl -fsSL https://pkgs.jaque.sh/install.sh | sh

This adds the signing key and the repository for whichever package manager it finds, then installs jaque through it. It writes nothing that is not listed on this page.

2. Debian and Ubuntu

The installer runs these four commands:

curl -fsSL https://pkgs.jaque.sh/gpg.key | gpg --dearmor -o /usr/share/keyrings/jaque.gpg

# /etc/apt/sources.list.d/jaque.sources
Types: deb
URIs: https://pkgs.jaque.sh/apt
Suites: stable
Components: main
Signed-By: /usr/share/keyrings/jaque.gpg

apt-get update
apt-get install -y jaque

3. Fedora and RHEL

# /etc/yum.repos.d/jaque.repo
[jaque]
name=jaque
baseurl=https://pkgs.jaque.sh/rpm
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://pkgs.jaque.sh/gpg.key

dnf install -y jaque

4. Verify the key

The signing key's fingerprint is:

8DE4 52E1 F156 DCAD 998E 0929 0ADA 1198 CE3B 4CC3

Compare it against what you downloaded:

curl -fsSL https://pkgs.jaque.sh/gpg.key -o gpg.key
gpg --show-keys gpg.key

5. Archives

https://pkgs.jaque.sh/bin/vX.Y.Z/ holds one archive per architecture (jaque_X.Y.Z_linux_amd64.tar.gz, jaque_X.Y.Z_linux_arm64.tar.gz), checksums.txt, its signature bundle, and the SBOMs. Verify the checksums file against the signature bundle before trusting anything inside it:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-oidc-issuer https://gitlab.com \
  --certificate-identity-regexp '<release job identity>' \
  checksums.txt

The exact identity is printed on the release page next to the archive you are verifying.

6. After installing

Edit /etc/jaque/config.cue, then start the service:

systemctl enable --now jaque
jaque version

The unit runs the binary as the jaque user with its environment in /etc/default/jaque; state lives in /var/lib/jaque. See Operations for durability, backups and upgrades.