What the installer does
What the one line fetches, what it verifies before anything lands, and the act it offers you next.
One line installs a machine:
It detects the machine's OS and architecture, downloads the machine payload —
{saphan,saphan-agent,saphan-gateway} — verifies each binary against the checksum manifest
(refusing if anything doesn't match, with nothing installed), and installs them into
~/.saphan/bin/. The copy is a same-directory temp file and a rename, never an in-place
overwrite — which on macOS can poison the per-inode code-signature cache and kill the next run.
Once the binaries are in place, install.sh offers the next act in the admission sequence
— generating this machine's certificate signing request — rather than stopping at
"installed":
Accepting runs <prefix>/saphan machine csr --machine <id> (always by its absolute install
path, never a bare saphan off your PATH) and prints where the .csr file landed —
carry that file to the owner's machine for saphan machine admit --csr <file> --transport local|ssh (the engine guesses no default transport; name the one this machine
actually uses). Declining — or running non-interactively, e.g. piped through curl | sh
with no controlling terminal, where the prompt is skipped outright rather than hanging —
prints the same command to run later instead. The default machine id is this host's own
short hostname; override with --machine <id>, or skip the prompt with --csr (run it
now) or --no-csr (just print the command). If a device key already exists on the machine,
the offer is skipped — that machine has already begun its admission.
The full admission flow — what the CSR is, what machine admit checks, and the refusals
you can meet — is Machines: enrollment and authentication.
Variants
A non-default install directory:
A seat that only runs agent workloads does not need the full saphan CLI:
⚠ Both need -s --. Without it the shell takes the flag and the script never sees it.
An install, end to end
One command, what it verifies before it writes anything, the line it prints, and the wizard it hands you — the whole path in the order you meet it.
Updating a fleet that is already installed
The same delivery, repeated — and the three traps that make it look like it worked when it did not.