The buff console with one command on Linux, macOS and Windows; the app as a package from the “Download” page. Signature check, updates and mass rollout.

Buff Code comes in two forms, with the same sign-in and the same features:

the buff console — a program in the terminal; installed with one command;
the app — a window for Linux, macOS and Windows; installed as a package.

You can install both: the app works with the same sign-in and the same working context.

Console

Linux and macOS (and Windows in Git Bash):

curl -fsSL https://buff.systems/install | bash

The script detects the system and the processor (including older processors without AVX2 and musl-based systems such as Alpine), downloads the right build, verifies the checksum and puts buff into ~/.buff/bin, adding the path to the shell profile. Flags and variables:

Flag or variable	What it does
`--version 2.0.11-buff.16` (or `-v`)	install a specific version
`--no-modify-path`	leave the shell profile alone
`BUFF_INSTALL_DIR`	install into another directory
`BUFF_VERSION`	the same as `--version`, but as an environment variable

Check:

buff --version

Open a new terminal if the command is not found: the path is in the profile, but the current shell has not read it yet.

App

Packages for Linux (AppImage, deb, rpm), macOS (Apple Silicon and Intel) and Windows are on the “Download” page. The app installs alongside the console and uses the same sign-in.

First launch on macOS and Windows

The app is signed with our key (see the check below), but is not yet notarised by Apple or Microsoft. So on the first launch of a downloaded package the system warns you:

macOS — “The developer cannot be verified”. Open System Settings → Privacy & Security and click “Open Anyway” next to Buff Code. Or remove the downloaded-from-the-internet flag: xattr -dr com.apple.quarantine "/Applications/Buff Code.app".
Windows — the SmartScreen window “Windows protected your PC”. Click “More info” → “Run anyway”.

This is asked once; updates install without questions. The console installed with the command above causes no warnings.

Signature check

Every release comes with SHA256SUMS and its signature. The verification key is the same as the connector’s:

V=2.0.11-buff.16
curl -fsSLO https://buff.systems/downloads/$V/SHA256SUMS
curl -fsSLO https://buff.systems/downloads/$V/SHA256SUMS.sig
curl -fsSLO https://buff.systems/downloads/cosign.pub
cosign verify-blob --key cosign.pub --signature SHA256SUMS.sig SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

Updates

The console and the app learn about a new release by themselves and update from the same place they were installed from. Manually:

buff upgrade            # to the latest release
buff upgrade 2.0.11-buff.16   # to a specific one

To remove the console together with its files — buff uninstall.

Mass rollout

To spare developers from entering the connector’s address, set it in advance with an environment variable: the sign-in form then does not ask for the address.

export BUFF_CONNECTOR_URL=https://connector.company.local:8767

The variable is handy to set in the shell profile, in the workstation image or in the installation script. The rest — the sign-in code, the organisation and the project — the developer chooses on first launch (see Sign-in and working context).

What gets installed on the machine

Console: the ~/.buff/bin directory with a single executable and a line in the shell profile.
App: an ordinary system package.
Buff Code’s data — the sign-in, the device key, the working context and the local session history — lives in the user’s data directory. Nothing is added to the system certificate store, and no administrator rights are needed.

Installation