Install on Linux with deb or rpm

Three Linux artifacts are published per architecture: a .deb, an .rpm, and a .tar.gz. All three carry the CLI only. Both x86_64 and aarch64 are built.

Supported floor

Debian 12 or Ubuntu 22.04 and newer, glibc 2.35 or later. The glibc floor is the real constraint — an older enterprise distribution with a newer kernel will still refuse to run the binary.

Installing

Install the package with your distribution's package manager, or unpack the tarball and place tovio on your PATH yourself. Every public package holds exactly one binary plus the licence and readme files; the git-credential-tovio helper is not among them, and a source build is currently the only way to get it.

Verify before you install

RPM releases are GPG-signed, and the corresponding public key is published as RPM-GPG-KEY-tovio alongside the packages; import it before installing so rpm can check the signature itself. Every artifact also carries a .sha256 sidecar and a Sigstore build-provenance attestation. See the verification article for the order to do these in.

Key storage: read this before you script it

On a desktop session, key storage uses the secret service (libsecret) under the service name tovio, and there is nothing to configure. What lives there is the 32-byte wrapping key, not your identity secret — the secret itself is sealed on disk at .tovio/identity/default.key inside the repository.

On a headless host — a server, a container, a CI runner — there is no secret-service daemon, and TOVIO does not fall back to an on-disk keystore. No such fallback backend exists. Key operations fail on purpose, because quietly downgrading key storage would be a security surprise. You either supply a wrapping key through TOVIO_KEYSTORE_KEY or TOVIO_KEYSTORE_KEY_FILE, or you use a Simple-mode repository, which needs no keychain at all. The headless-host article has the exact rules.

Uninstalling

Removing the package removes the binary and nothing else. Repositories keep their .tovio/ directories — including their sealed identities — wrapping keys stay in the secret service, and git credentials stay under $XDG_CONFIG_HOME/tovio/git-credentials.