chainctl
chainctl Chainguard Control
For the complete documentation index, see llms.txt.
Update chainctl.
Update chainctl to the latest release.
When signature verification is enabled (currently opt-in via CHAINCTL_EXPERIMENTAL_UPDATE_VERIFY=true), the downloaded binary’s signature is verified before it is installed; a binary that fails verification is never installed. Verification requires network access to the download host (dl.enforce.dev) and, at least on first use, to the Sigstore TUF CDN (tuf-repo-cdn.sigstore.dev). If those hosts are unreachable (for example, behind a restrictive proxy), the update fails and the current binary is left in place; as a fallback, download the latest release directly from https://dl.enforce.dev/chainctl/latest/.
chainctl update [--yes] [--force] --force Skip the version check and update chainctl regardless of the current version.
-y, --yes Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively. --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
--audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev")
--config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
--console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
--force-color Force color output even when stdout is not a TTY.
-h, --help Help for chainctl
--issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
--log-level string Set the log level (debug, info) (default "ERROR")
-o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
-v, --v int Set the log verbosity level.Last updated: 2026-07-22 19:49