Installing

otisk is one binary, otisk, which talks to a gateway over SSH. Installing it needs no credential: the packages and their signatures are public, and your SSH key is what identifies you once you use it.

Arch

Trust the key that signs otisk's releases, once. Check the fingerprint rather than believing the file:

sudo pacman-key --add release-key.gpg
sudo pacman-key --finger 79F62868A12BC6B9   # 2FDF 670A A060 F841 8BC9  33EB 79F6 2868 A12B C6B9
sudo pacman-key --lsign-key 79F62868A12BC6B9

Add the repository to the end of /etc/pacman.conf:

[otisk]
SigLevel = Required DatabaseRequired
Server = https://pub-0e2e5578296e460fa8f9f693f4ad4411.r2.dev/arch/$arch

Required DatabaseRequired means pacman installs nothing from this repository that key has not signed, and reads no database it has not signed either.

sudo pacman -Sy
sudo pacman -S otisk
otisk version

macOS

Homebrew checks the SHA-256 the formula pins, which came from the release manifest.

brew tap otiskdev/otisk
brew install otisk
otisk version

From a clone

Go 1.27 or later:

git clone <the repository> otisk && cd otisk
make build          # bin/otisk and bin/git-gateway

bin/otisk is the client. bin/git-gateway is the server, which you only need if you are running one.

Upgrading

Whatever installed it maintains it. The client has no way to update itself.

sudo pacman -Syu        # Arch, with everything else
sudo pacman -Sy otisk   # Arch, otisk alone
brew upgrade otisk      # macOS

Upgrading otisk alone is safe here, though Arch warns against partial upgrades in general: the client is a static binary linked against nothing, and its dependencies — git and openssh — are executables it runs rather than libraries it links, so there is no version skew for a partial upgrade to cause.

What you need besides otisk

git 2.29 or later, ssh, and ssh-keygen. Git 2.29 is the version that introduced the proc-receive hook, which is what makes pushing for review work.