vanta 0.0.9

Vanta — every developer tool, one command. The main CLI binary.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

# Vanta

**Every developer tool, one command.**

Vanta installs, pins, and switches developer tools and language runtimes from a
single binary — verified downloads, content-addressed storage, per-directory
version switching, and source builds for tools that ship no prebuilt binaries.

## Install

```sh
curl --proto '=https' --tlsv1.2 -fsSL \
  https://raw.githubusercontent.com/squaretick/vanta/main/scripts/install.sh | sh
```

Or with cargo:

```sh
cargo install vanta
```

## Use

```sh
vanta add node@24        # resolve + install (verified)
vanta add ruby@3.3.6     # source build (compiles from source)
vanta search ''          # list the registry
vanta info go            # show a tool's versions
eval "$(vanta activate zsh)"   # per-directory version switching
```

## What's in the registry

Prebuilt tools (full upstream version history where checksums allow): node, go,
python, uv, ripgrep, fd, jq, terraform, gh, pnpm, deno, bun, kubectl, helm,
just, fzf, yq, zoxide, bat, delta.

Source-build tools (compiled locally from checksum-verified source): ruby, git,
lua, and the GNU set (grep, sed, gawk, wget, tar, findutils, diffutils, make).

## Security

The official registry is fetched over HTTPS and verified against a compiled-in
minisign **root public key**; every artifact is checksum-gated (fail-closed).
Archive extraction is hardened against path traversal and decompression bombs.
See [SECURITY.md](https://github.com/squaretick/vanta/blob/main/SECURITY.md).

## Links

- Repository: <https://github.com/squaretick/vanta>
- CLI reference: `docs/04-cli.md`
- License: Apache-2.0