Installation Guide

Timoni is available as a binary executable for Linux, macOS and Windows. The AMD64 and ARM64 binaries can be downloaded from GitHub releases.

Install timoni on macOS or Linux with:

brew install timoni

If you prefer to use the latest upstream binaries:

brew install stefanprodan/tap/timoni

Note that the Homebrew formula will setup shell autocompletion for Bash, Fish and Zsh.

Install the latest release on macOS, Linux or Windows with:

mise use timoni

Note that you need to manually configure shell autocompletion.

Install the latest release on Windows with:

scoop install timoni

View the available versions using scoop.sh. The cue dependency will also be installed if necessary.

Install timoni with nix-env:

nix-env -i timoni

or with Flakes:

nix profile install nixpkgs#timoni

Note that the Nix package will setup shell autocompletion for Bash, Fish and Zsh.

Install the latest release with yay (or another AUR helper) for Arch Linux:

yay -S timoni

If you prefer to use the upstream binaries:

yay -S timoni-bin

Manage multiple versions with proto for all supported systems:

# .prototools file

timoni = "0.34.0"

[plugins]
timoni = "source:https://raw.githubusercontent.com/stefanprodan/timoni/main/proto-plugin.toml"

Install the latest release with zypper for openSUSE:

zypper install timoni

To setup shell autocompletion:

zypper install timoni-bash-completion
zypper install timoni-fish-completion
zypper install timoni-zsh-completion

Install the latest release on Windows, macOS or Linux with:

arkade get timoni

Using Go >= 1.27:

go install github.com/stefanprodan/timoni/cmd/timoni@latest

Shell autocompletion

Configure your shell to load timoni completions:

Bash
Fish
Powershell
Zsh

Add to your ~/.bashrc or ~/.bash_profile:

command -v timoni >/dev/null && . <(timoni completion bash)

If you have an alias for timoni, you can extend shell completion to work with that alias:

alias tm=timoni
complete -F __start_timoni tm

Write the completion script to your completions dir:

timoni completion fish > ~/.config/fish/completions/timoni.fish

Add the completion script to your powershell profile.Windows:

cd "$env:USERPROFILE\Documents\WindowsPowerShell\Modules"
timoni completion >> timoni-completion.ps1

Linux:

cd "${XDG_CONFIG_HOME:-"$HOME/.config/"}/powershell/modules"
timoni completion >> timoni-completions.ps1

Add to your ~/.zshrc or ~/.profile:

command -v timoni >/dev/null && . <(timoni completion zsh) && compdef _timoni timoni

Alternatively, install the completion script into one of the directories in your ${fpath}:

echo "${fpath// /\n}" | grep -i completion
timoni completion zsh > _timoni

mv _timoni ~/.oh-my-zsh/completions  # oh-my-zsh
mv _timoni ~/.zprezto/modules/completion/external/src/  # zprezto

Local cache

Timoni maintains a local cache of modules pulled from remote container registries. Cashing is meant to reduce network traffic for sequential pull operations and speeds up applying bundles which refer to modules with identical layers. The default cache location is $HOME/.timoni/cache and can be changed with either the --cache-dir global flag or TIMONI_CACHE_DIR environment variable. The global flag takes precedence over the environment variable. If the home directory is not writable, caching can be disabled by setting the TIMONI_CACHING=false environment variable.

SLSA Provenance & SBOMs

The build, release and provenance portions of Timoni’s supply chain meet the SLSA Build Level 3 requirements. The release artifacts are produced on GitHub-hosted runners using GoReleaser and the provenance generation is handled by the official SLSA GitHub Generator. To verify a release artifact such as the Timoni binary tarball, you can use the slsa-verifier tool:

TIMONI_VER=0.34.0 && \
gh release download v${TIMONI_VER} -R=stefanprodan/timoni -p="*" && \
slsa-verifier verify-artifact \
--provenance-path timoni_${TIMONI_VER}_provenance.intoto.jsonl \
--source-uri github.com/stefanprodan/timoni  \
--source-tag v${TIMONI_VER} \
timoni_${TIMONI_VER}_darwin_arm64.tar.gz

The release artifacts are also attested with GitHub artifact attestations. To verify a release artifact with the GitHub CLI:

TIMONI_VER=0.34.0 && \
gh release download v${TIMONI_VER} -R=stefanprodan/timoni -p="timoni_${TIMONI_VER}_darwin_arm64.tar.gz" && \
gh attestation verify timoni_${TIMONI_VER}_darwin_arm64.tar.gz \
--repo stefanprodan/timoni \
--signer-workflow stefanprodan/timoni/.github/workflows/release.yaml \
--source-ref refs/tags/v${TIMONI_VER}

The Timoni GitHub Action performs the same verification before installing the binary on GitHub runners. Each release comes with a Software Bill of Materials (SBOM) in SPDX format. The SBOMs are generated on GitHub-hosted runners using GoReleaser and Syft. To scan a release for vulnerabilities, you can use Grype:

TIMONI_VER=0.34.0 && \
gh release download v${TIMONI_VER} -R=stefanprodan/timoni -p="*sbom.spdx.json" && \
grype sbom:./timoni_${TIMONI_VER}_sbom.spdx.json

Get Started

App Delivery

App Packaging

Integrations

Installation Guide

Shell autocompletion

Local cache

SLSA Provenance & SBOMs

​Shell autocompletion

​Local cache

​SLSA Provenance & SBOMs

Shell autocompletion

Local cache

SLSA Provenance & SBOMs