Install the Frontier CLI

Install the Frontier CLI (frontier) with one curl command, or from the apt and dnf repositories. Every release is signed, and every channel can be mirrored inside customer-controlled environments.

The Frontier CLI (frontier) is a single binary for Linux, macOS and Windows. Downloads need no account and no sign-in. Every release is signed: the SHA256SUMS file is signed with the Federal Frontier release key, and every archive and package is pinned by that file. The download host serves the CLI binaries only. Every channel below can be mirrored inside your own network, so you stay in control of what runs in your customer-controlled environment.

Current version: 5.9.2 · Download host: https://downloads.federalfrontier.ai/frontier-cli

Linux and macOS: install script

curl -fsSL https://downloads.federalfrontier.ai/frontier-cli/install.sh | sh

The script:

• detects your OS (Linux or macOS) and CPU (amd64 or arm64); override with FRONTIER_OS / FRONTIER_ARCH;
• downloads the archive and SHA256SUMS, checks the signature when cosign is on your PATH, and always checks the SHA-256;
• checks that the binary reports the expected version before installing it;
• installs to /usr/local/bin when run as root (or when that directory is writable), otherwise to ~/.local/bin. It does not call sudo.

If any file is missing, a checksum does not match, or the signature is bad, the script stops and installs nothing.

What to expect: the script prints signature OK (when cosign is installed) and checksum OK, then the path it installed to, for example installed /home/you/.local/bin/frontier (5.9.2, linux-amd64, signature: verified). Without cosign it prints cosign not found; skipping signature check (checksum still enforced). If the install directory is not on your PATH, it tells you to add it.

Options (environment variables):

Recommended for regulated environments:

curl -fsSL https://downloads.federalfrontier.ai/frontier-cli/install.sh | FRONTIER_REQUIRE_SIGNATURE=1 sh

Debian / Ubuntu (apt)

sudo curl -fsSL https://downloads.federalfrontier.ai/frontier-cli/frontier-archive-keyring.gpg \
  -o /usr/share/keyrings/frontier-archive-keyring.gpg
echo 'deb [signed-by=/usr/share/keyrings/frontier-archive-keyring.gpg] https://downloads.federalfrontier.ai/frontier-cli/apt stable main' \
  | sudo tee /etc/apt/sources.list.d/frontier.list
sudo apt-get update
sudo apt-get install -y frontier

Expected (Debian 12, amd64):

Unpacking frontier (5.9.2) ...
Setting up frontier (5.9.2) ...
$ frontier version
Federal Frontier Platform — frontier-cli v5.9.2

Upgrade with sudo apt-get install --only-upgrade frontier; remove with sudo apt-get remove frontier.

RHEL / Rocky / Alma / Fedora (dnf)

sudo curl -fsSL https://downloads.federalfrontier.ai/frontier-cli/yum/frontier.repo \
  -o /etc/yum.repos.d/frontier.repo
sudo dnf install -y frontier

dnf asks you to confirm the repository key on first use. Check that the fingerprint matches:

Importing GPG key 0x7397E656:
 Fingerprint: DF6B A5CD 2379 D839 FFDF D19B C6B3 B4D5 7397 E656
...
Installed:
  frontier-5.9.2-1.aarch64
Complete!

x86_64 hosts get frontier-5.9.2-1.x86_64. The repository metadata is signed (repo_gpgcheck=1), and each package is pinned by the signed metadata. Upgrade with sudo dnf upgrade frontier; remove with sudo dnf remove frontier.

macOS: Homebrew

Homebrew installation is coming soon.

Windows (amd64)

PowerShell:

irm https://downloads.federalfrontier.ai/frontier-cli/install.ps1 | iex

Download: frontier-5.9.2-windows-amd64.zip (SHA-256 b7cee3cebe0937b1a1d1dc1d02523a0547d7784a95e895c2cc4e6a93fcb3cf7e)

Direct downloads (v5.9.2)

Verify a download yourself

B=https://downloads.federalfrontier.ai/frontier-cli
curl -fsSLO $B/v5.9.2/SHA256SUMS
curl -fsSLO $B/v5.9.2/SHA256SUMS.sig
curl -fsSLO $B/cosign.pub
cosign verify-blob --key cosign.pub --signature SHA256SUMS.sig --insecure-ignore-tlog=true SHA256SUMS
# Verified OK
curl -fsSLO $B/v5.9.2/frontier-5.9.2-linux-amd64.tar.gz
sha256sum --ignore-missing -c SHA256SUMS
# frontier-5.9.2-linux-amd64.tar.gz: OK

--insecure-ignore-tlog=true is expected: Frontier releases are verified against the published key only, with no dependency on any public transparency log, so verification also works offline.

SHA-256 for 5.9.2:

5fd8fa8bdda7c40b2f745d9eb6f065a8e169ff55d5e702544a448d5444005e09  frontier-5.9.2-linux-amd64.tar.gz
642eef91d6c260f093d0b30f10d661c1e72c9ca3d447f197f99ed3bd60c68eed  frontier-5.9.2-linux-arm64.tar.gz
7eb9e49dd700036c8bb2ffbb5f3a9f7f45b436758212f93a10d1d276d7fe258e  frontier-5.9.2-darwin-arm64.tar.gz
b2195aed31a9f923d4757f75c9b3e895d2ceb11d943fa878c7eaea702d3d7743  frontier-5.9.2-darwin-amd64.tar.gz
b7cee3cebe0937b1a1d1dc1d02523a0547d7784a95e895c2cc4e6a93fcb3cf7e  frontier-5.9.2-windows-amd64.zip
94e712f1969c12174b533e6483751247249c58a3619cceb6d29ab8ce64547adf  frontier_5.9.2_amd64.deb
5da195e60c4954c8488535eabeb664e54892ae489fb663d2fab27d94c0318462  frontier_5.9.2_arm64.deb
158c803b3bba53588a5fd3d8437e58d68fd6d8df37bfd998a90cabeb0603a9df  frontier-5.9.2-1.x86_64.rpm
0c19c54e674fdaafdfa586c156317158ed17d2a558101351a038544f9d8312db  frontier-5.9.2-1.aarch64.rpm

Air-gapped networks and mirrors

Offline bundle: frontier-5.9.2-offline.tar.gz (SHA-256 2eb0f71c27e0c26f3d7779af830ca76722f5ce9e87613e50c58b27c7070d709f). It contains every archive and package, SHA256SUMS, its signature, cosign.pub, install.sh and install.ps1.

tar xzf frontier-5.9.2-offline.tar.gz && cd frontier-5.9.2-offline
FRONTIER_LOCAL_DIR=$PWD sh install.sh

Your own mirror: the download host is a static file tree. Unpack the offline bundle into <mirror>/frontier-cli/v5.9.2/, copy install.sh, cosign.pub and latest.txt to <mirror>/frontier-cli/, then:

curl -fsSL https://mirror.example.lan/frontier-cli/install.sh | FRONTIER_BASE_URL=https://mirror.example.lan/frontier-cli sh

After installing

frontier version
# Federal Frontier Platform — frontier-cli v5.9.2

To enroll an AI Workstation, see Enrolling an AI Workstation.