Installation Guide
Timoni is available as a binary executable for Linux, macOS and Windows. The AMD64 and ARM64 binaries can be downloaded from GitHub releases.
Install timoni on macOS or Linux with:
brew install timoni
If you prefer to use the latest upstream binaries:
brew install stefanprodan/tap/timoni
Note that the Homebrew formula will setup shell autocompletion for Bash, Fish and Zsh.
Install the latest release on macOS, Linux or Windows with:
mise use timoni
Note that you need to manually configure shell autocompletion.
Install the latest release on Windows with:
scoop install timoni
View the available versions using scoop.sh. The cue dependency will also be installed if necessary.
Install timoni with nix-env:
nix-env -i timoni
or with Flakes:
nix profile install nixpkgs#timoni
Note that the Nix package will setup shell autocompletion for Bash, Fish and Zsh.
Install the latest release with yay (or another AUR helper) for Arch Linux:
yay -S timoni
If you prefer to use the upstream binaries:
yay -S timoni-bin
Manage multiple versions with proto for all supported systems:
# .prototools file
timoni = "0.29.0"
[plugins]
timoni = "source:https://raw.githubusercontent.com/stefanprodan/timoni/main/proto-plugin.toml"
Install the latest release with zypper for openSUSE:
zypper install timoni
To setup shell autocompletion:
zypper install timoni-bash-completion
zypper install timoni-fish-completion
zypper install timoni-zsh-completion
Install the latest release on Windows, macOS or Linux with:
arkade get timoni
Using Go >= 1.26:
go install github.com/stefanprodan/timoni/cmd/timoni@latest
Shell autocompletion
Configure your shell to load timoni completions:
Add to your ~/.bashrc or ~/.bash_profile:
command -v timoni >/dev/null && . <(timoni completion bash)
If you have an alias for timoni, you can extend shell completion to work with that alias:
alias tm=timoni
complete -F __start_timoni tm
Write the completion script to your completions dir:
timoni completion fish > ~/.config/fish/completions/timoni.fish
Add the completion script to your powershell profile.
Windows:
cd "$env:USERPROFILE\Documents\WindowsPowerShell\Modules"
timoni completion >> timoni-completion.ps1
Linux:
cd "${XDG_CONFIG_HOME:-"$HOME/.config/"}/powershell/modules"
timoni completion >> timoni-completions.ps1
Add to your ~/.zshrc or ~/.profile:
command -v timoni >/dev/null && . <(timoni completion zsh) && compdef _timoni timoni
Alternatively, install the completion script into one of the directories in your ${fpath}:
echo "${fpath// /\n}" | grep -i completion
timoni completion zsh > _timoni
mv _timoni ~/.oh-my-zsh/completions # oh-my-zsh
mv _timoni ~/.zprezto/modules/completion/external/src/ # zprezto
Local cache
Timoni maintains a local cache of modules pulled from remote container registries. Cashing is meant to reduce network traffic for sequential pull operations and speeds up applying bundles which refer to modules with identical layers.
The default cache location is $HOME/.timoni/cache and can be changed with either the
--cache-dir global flag or TIMONI_CACHE_DIR environment variable. The global flag
takes precedence over the environment variable.
If the home directory is not writable, caching can be disabled by
setting the TIMONI_CACHING=false environment variable.
SLSA Provenance & SBOMs
The build, release and provenance portions of Timoni's supply chain meet the SLSA Build Level 3 requirements.
The release artifacts are produced on GitHub-hosted runners using GoReleaser and the provenance generation is handled by the official SLSA GitHub Generator.
To verify a release artifact such as the Timoni binary tarball, you can use the slsa-verifier tool:
TIMONI_VER=0.29.0 && \
gh release download v${TIMONI_VER} -R=stefanprodan/timoni -p="*" && \
slsa-verifier verify-artifact \
--provenance-path timoni_${TIMONI_VER}_provenance.intoto.jsonl \
--source-uri github.com/stefanprodan/timoni \
--source-tag v${TIMONI_VER} \
timoni_${TIMONI_VER}_darwin_arm64.tar.gz
Each release comes with a Software Bill of Materials (SBOM) in SPDX format. The SBOMs are generated on GitHub-hosted runners using GoReleaser and Syft.
To scan a release for vulnerabilities, you can use Grype:
TIMONI_VER=0.29.0 && \
gh release download v${TIMONI_VER} -R=stefanprodan/timoni -p="*sbom.spdx.json" && \
grype sbom:./timoni_${TIMONI_VER}_sbom.spdx.json