Installing OpenTofu from GitHub Releases

Using the installer script

Linux/MacOS/BSD/Unix (POSIX)
Windows (PowerShell)

Code Block# Download the installer script:
curl --proto '=https' --tlsv1.2 -fsSL https://get.opentofu.org/install-opentofu.sh -o install-opentofu.sh
# Alternatively: wget --secure-protocol=TLSv1_2 --https-only https://get.opentofu.org/install-opentofu.sh -O install-opentofu.sh

# Grant execution permissions:
chmod +x install-opentofu.sh

# Please inspect the downloaded script at this point.

# Run the installer:
./install-opentofu.sh --install-method standalone

# Remove the installer:
rm -f install-opentofu.sh

Note

The standalone installer verifies the integrity of the downloaded files. You need to install cosign, GnuPG, or disable the integrity verification by using the --skip-verify option.

Code Block# Download the installer script:
Invoke-WebRequest -outfile "install-opentofu.ps1" -uri "https://get.opentofu.org/install-opentofu.ps1"

# Please inspect the downloaded script at this point.

# Run the installer:
& .\install-opentofu.ps1 -installMethod standalone

# Remove the installer:
Remove-Item install-opentofu.ps1

Note

If you run into script execution policy issues when running this script, please run Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope Process before running the installer.

Note

The standalone installer verifies the integrity of the downloaded files. You need to install cosign, GnuPG, or disable the integrity verification by using the -skipVerify option.

Using OpenTofu as a standalone binary

You can run OpenTofu without installation as a standalone binary. You can download the latest release for your operating system from the GitHub releases page, unpack the zip and start using it. For easier updates, we recommend using the non-portable packaged versions for your operating system.

Community-supported Architectures

Note

These are builds for architectures that OpenTofu does not officially support. Please raise issues about these builds with their maintainers.

Download the latest binary for ppc64le here. Contact the ppc64le maintainer for issues related to this binary.

Verify the file integrity

Please download the tofu_YOURVERSION_SHA256SUMS file from the release. This file contains the SHA256 checksums for all files. You can verify the integrity of your file by running:

Linux (sha256sum)
MacOS (shasum)
Windows (PowerShell)

Code BlockZIPFILE=tofu_*.zip
CHECKSUM=$(sha256sum "${ZIPFILE}" | cut -f 1 -d ' ')
EXPECTED_CHECKSUM=$(grep "${ZIPFILE}" tofu_*_SHA256SUMS | cut -f 1 -d ' ')
if [ "${CHECKSUM}" = "${EXPECTED_CHECKSUM}" ]; then
    echo "OK"
else
    echo "MISMATCH"
fi

Code BlockZIPFILE=tofu_*.zip
CHECKSUM=$(shasum -a 256 "tofu_*.zip" | cut -f 1 -d ' ')
EXPECTED_CHECKSUM=$(grep "${ZIPFILE}" tofu_*_SHA256SUMS | cut -f 1 -d ' ')
if [ "${CHECKSUM}" = "${EXPECTED_CHECKSUM}" ]; then
    echo "OK"
else
    echo "MISMATCH"
fi

Code Block$zipFile="tofu_YOURVERSION_REPLACEME.zip"
$checksum = $(Get-FileHash -Algorithm SHA256 $zipFile).Hash
$expectedChecksum = $((Get-Content "tofu_YOURVERSION_REPLACEME_SHA256SUMS" | Select-String -Pattern $zipFile) -split '\s+')[0]
if ($realHash -ne $expectedHash) {
    Write-Error "Checksum mismatch"
}

Verifying the binaries with Cosign

After you have verified the checksums, you can verify the integrity of the checksum file itself with Cosign. Please make sure you have installed Cosign and download the tofu_YOURVERSION_SHA256SUMS.pem and tofu_YOURVERSION_SHA256SUMS.sig files for your release. You can then run the integrity verification:

Linux/MacOS/BSD/UNIX (POSIX)
Windows (PowerShell)

Code BlockOPENTOFU_VERSION_MAJORMINOR="Add your OpenTofu major and minor version here"
IDENTITY="https://github.com/opentofu/opentofu/.github/workflows/release.yml@refs/heads/v${OPENTOFU_VERSION_MAJORMINOR}"
# For alpha and beta builds use /main
cosign \
    verify-blob \
    --certificate-identity "${IDENTITY}" \
    --signature tofu_*.sig \
    --certificate tofu_*.pem \
    --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
    tofu_*_SHA256SUMS

Code Block$version = [version]"YOUR_OPENTOFU_VERSION"
$identity = "https://github.com/opentofu/opentofu/.github/workflows/release.yml@refs/heads/v${version.Major}.${version.Minor}"
# For alpha and beta builds use /main
cosign.exe `
    verify-blob `
    --certificate-identity $identity `
    --signature "tofu_YOURVERSION_REPLACEME.sig" `
    --certificate "tofu_YOURVERSION_REPLACEME.pem" `
    --certificate-oidc-issuer "https://token.actions.githubusercontent.com" `
    "tofu_YOURVERSION_REPLACEME_SHA256SUMS"

Copyright (c) The OpenTofu Authors
Copyright (c) 2014 HashiCorp, Inc.
Mozilla Public License, version 2.0
https://opentofu.org/docs/v1.9/intro/install/standalone/

Installing OpenTofu from GitHub Releases

Using the installer script​

Using OpenTofu as a standalone binary​

Community-supported Architectures​

Verify the file integrity​

Verifying the binaries with Cosign

Using the installer script

Using OpenTofu as a standalone binary

Community-supported Architectures

Verify the file integrity