# Installation (/docs/installation)





LPM CLI ships as a single binary, distributed through several channels. Pick whichever fits your workflow — they install the same release.

## npm [#npm]

```bash
npm install -g @lpm-registry/cli
```

Works on every currently supported platform, including Windows. Official x64 Alpine Linux packages are upcoming and are not included in v0.67.0. The npm package is a dependency-free launcher; npm installs the matching platform-native Rust package through `optionalDependencies`, then runs a small `postinstall` verifier that checks the native binary and wires the global command to it.

If your npm config omits optional dependencies (`--omit=optional`, `--no-optional`, or a package-manager policy), reinstall with optional dependencies enabled. If install scripts are disabled (`--ignore-scripts`), the JS launcher stays in place and resolves the native package at runtime, but first-run validation and zero-overhead Unix linking are skipped.

## Homebrew (macOS, Linux) [#homebrew-macos-linux]

```bash
brew tap lpm-dev/lpm
brew install lpm
```

The formula auto-updates with every release.

## Standalone installer (macOS, Linux) [#standalone-installer-macos-linux]

```bash
curl -fsSL https://cli.lpm.dev/install | sh
```

Downloads the latest binary into `~/.lpm/bin` and adds it to your `PATH` (`.zshrc`, `.bashrc`, or `config.fish` depending on your shell). The upcoming x64 Alpine Linux release will make the installer distinguish glibc from musl and select the matching binary automatically. Open a new terminal — or `source` the rc file — and you're done.

The installer always verifies the downloaded binary's SHA-256 digest against the release manifest. When `cosign` is available, it also authenticates that manifest against the release workflow's Sigstore identity; without `cosign`, the check proves consistency with the downloaded manifest but does not authenticate who produced it. The installer also refuses releases below its minimum security floor. Two recovery overrides exist for release incidents and broken bootstrap environments: `LPM_INSTALL_INSECURE=1` skips all integrity checks, while `LPM_INSTALL_MIN_VERSION_OVERRIDE=1` permits an older release but keeps the normal verification behavior.

For Windows, use the npm installer above.

## From source (Cargo) [#from-source-cargo]

```bash
cargo install --git https://github.com/lpm-dev/rust-client lpm-cli
```

Builds from the latest `main`. Requires Rust 1.94 or newer.

On ARM64 Alpine Linux, install the native build prerequisites first:

```bash
apk add --no-cache build-base cmake perl pkgconf
```

ARM64 musl does not currently have an official prebuilt binary, so source installation is the supported fallback on that platform.

## Verify [#verify]

```bash
lpm --version
# lpm 0.41.0
```

```bash
lpm doctor
```

`lpm doctor` runs a project-and-environment health check (Node detection, registry reachability, store integrity, sandbox availability). Pass `--fix` to auto-repair what it can.

## Updating [#updating]

```bash
lpm self-update
```

Pulls the latest release for whichever channel you installed from, pinning the exact resolved version on npm and Cargo. (Homebrew users can also run `brew upgrade lpm`; npm users can use `npm install -g @lpm-registry/cli@latest` for the channel-latest dist-tag.)

## Uninstalling [#uninstalling]

```bash
# npm
npm uninstall -g @lpm-registry/cli

# Homebrew
brew uninstall lpm && brew untap lpm-dev/lpm

# Standalone
rm -rf ~/.lpm/bin/lpm
# Optional: also remove the global store and caches
rm -rf ~/.lpm
```

`~/.lpm/` holds the global content-addressable store, caches, and config. Removing it is safe — LPM CLI will recreate what it needs on the next install.

## What got installed [#what-got-installed]

| Path                 | Contains                                                                                                                                                   |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `~/.lpm/bin/lpm`     | The binary itself (or a shim from npm/Homebrew)                                                                                                            |
| `~/.lpm/store/`      | Content-addressable package store — extracted bytes (`objects/`) and per-graph wrapper directories (`links/`), shared across every project on this machine |
| `~/.lpm/cache/`      | Ephemeral metadata and download caches                                                                                                                     |
| `~/.lpm/global/`     | Globally-installed CLIs (`lpm install -g …`)                                                                                                               |
| `~/.lpm/config.toml` | User-level config (created on demand)                                                                                                                      |

See [Reference → Configuration](/docs/reference) for what lives where.

## Next [#next]

<Cards>
  <Card title="Your first install" href="/docs/first-install" description="A two-minute walkthrough." />

  <Card title="Registries" href="/docs/registries" description="How LPM CLI routes to npm, LPM.dev Registry, and private registries." />

  <Card title="Migrating" href="/docs/migrating" description="Move an existing project from npm, pnpm, yarn, or bun." />
</Cards>