GuideStablev3.7.0

Install Fendix

Choose a supported installation path and verify the installed engine.

On this page

How should I install Fendix for local use, CI, or complete hybrid coverage?

Choose the delivery that matches the job

The get.fendix.dev installer is the recommended first-run path on macOS or Linux and works well on POSIX CI runners.
Homebrew is the managed-upgrade alternative for developer laptops.
The official Docker image includes the version-matched Python analyzer tree and is the complete hybrid-coverage path.
.deb, .rpm, manual binary, and source builds remain supported for controlled environments.

Recommended first install

The installer verifies the SHA-256 checksum before placing the binary on PATH. Inspect the script first when required by your organization’s software-installation policy.

When cosign is installed the installer also verifies the release signature and refuses a binary that fails it. Set FENDIX_REQUIRE_SIGNATURE=1 to refuse the install unless that signature verifies, and FENDIX_SHA256 to accept only the binary whose hash you pinned.

terminal

curl -fsSL https://get.fendix.dev/install.sh | sh
fendix version

Homebrew-managed install

The official Fendix Homebrew tap selects the matching macOS or Linux architecture and supports brew upgrade fendix.

terminal

brew tap Fendix-app/fendix
brew trust --formula Fendix-app/fendix/fendix
brew install fendix

Complete hybrid coverage with Docker

The official multi-architecture image includes the version-matched Python analyzer tree. Pin a digest rather than a tag for reproducible CI.

terminal

docker pull fendixapp/fendix:3.7.0
docker run --rm fendixapp/fendix:3.7.0 version

Build from source

Use a source checkout for contributor work or when you need the matching Python tree directly. This path requires the documented Go and Python toolchains.

terminal

git clone https://github.com/Fendix-app/Fendix.git
cd Fendix
make build
./bin/fendix version
pip install -r python/requirements.txt

Verify release artifacts

Release binaries, packages, and the multi-architecture image publish checksum and keyless-signing material. Follow release verification for the pinned digest and current cosign identity; do not copy a mutable tag into a reproducible gate.

Know what the package contains

Standalone packages ship the Go binary, not the Python analyzer tree. A --code scan continues with native analyzers when that tree is unavailable and records python-engine as skipped/dependency_missing. Use the official container or a source checkout when policy requires that coverage.

Why does this work this way?

Read Coverage before choosing a CI delivery. For pinned versions, packages, source builds, and signature verification, use the official installation reference.