Native kfd CLI

KFD publishes a Rust-native executable named kfd for every supported desktop target. The name is stable across upgrades: POSIX archives contain kfd, and Windows archives contain kfd.exe.

Install with Homebrew

On macOS or Linux, install the native CLI from the Kungfu Systems tap:

brew install kungfu-systems/tap/kfd
kfd --version

No coding is required to install the CLI or use it to verify an existing KFD report. Homebrew selects the native archive for arm64 or x86_64 and keeps the user-facing executable name kfd across upgrades.

Download and verify

Choose the archive for your operating system and architecture from the matching KFD GitHub Release. Asset names have this permanent shape:

kfd-<version>-x86_64-unknown-linux-gnu.tar.gz
kfd-<version>-aarch64-unknown-linux-gnu.tar.gz
kfd-<version>-x86_64-apple-darwin.tar.gz
kfd-<version>-aarch64-apple-darwin.tar.gz
kfd-<version>-x86_64-pc-windows-msvc.zip

Each target also has kfd-<version>-<target>.sha256 and kfd-<version>-<target>.provenance.json. Download all three files for your target, then verify the archive and provenance bytes against the checksum file:

shasum -a 256 -c kfd-<version>-<target>.sha256

After extraction, put kfd somewhere on your PATH and confirm the exact release identity:

kfd --version

The output is kfd <version>, where <version> exactly matches the GitHub Release tag without its leading v.

Native capability boundary

The native binary is the offline Rust verifier. It supports:

kfd verify <kind> <path> [--schema <path>] [--json]
kfd bundle <kind> <path> --output <bundle.json>

The npm-hosted kfd command has a broader orchestration surface, including commands such as gate, scaffold, and test. Those commands are not hidden inside the native binary and are not claimed as native capabilities. Use the npm package when you need host orchestration; use the native binary when you need the directly compiled offline verifier.

Native and WebAssembly verification share the same verification bundles, reports, positive fixtures, negative fixtures, and issue ordering. A passing report remains structural, offline, non-qualifying, and non-self-certified.

Provenance

The per-target provenance document binds the KFD version, source commit and tree, Rust toolchain, executable digest, archive digest, target triple, and smoke-test boundary. Release promotion uploads the exact pull-request-built bytes and fails if a required payload is missing or if two payloads would use the same public asset name.