INFRAPIPE

An opinionated CLI for provisioning secure cloud infrastructure. One workflow across Terraform, OpenTofu, Pulumi, CloudFormation, Bicep and ARM templates. One command set across AWS, Azure, GCP, Cloudflare, DigitalOcean, OCI, Incus, LXD and Kubernetes.

BINARIES ONLY

We publish the compiled binaries, container images and documentation under the MIT license. The source code is not published.

See the latest release Docs and README

INSTALL

Linux and macOS. The installer detects your platform, verifies the SHA-256 checksum and installs:

curl -fsSL https://raw.githubusercontent.com/foolswithtools/infrapipe-releases/main/install.sh | bash

Docker. Signed, multi-arch images with infrapipe, OpenTofu and git. Mount your project at /workspace:

docker run --rm -v "$PWD:/workspace" ghcr.io/foolswithtools/infrapipe:latest validate system

Windows: download infrapipe-windows-amd64.exe and its .sha256 from the releases page and compare the hash.

VERIFY WHAT YOU DOWNLOAD

Every release asset has a SHA-256 checksum file. Binaries, checksum files and SBOMs are also signed with cosign (keyless, from GitHub's OIDC), and the container images are signed and carry an SBOM attestation.

cosign verify-blob --bundle infrapipe-linux-amd64.sigstore.json --certificate-identity
					"https://github.com/foolswithtools/infrapipe-releases/.github/workflows/sign-release.yml@refs/heads/main"
					--certificate-oidc-issuer https://token.actions.githubusercontent.com infrapipe-linux-amd64

The README has the full steps, including how to verify the images and what to allow-list behind a corporate proxy.