# Policy stores: CLI upload (binary)

## Installation

`cerbosctl` binaries are available for multiple operating systems and architectures. See the [releases page](https://github.com/cerbos/cerbos/releases/tag/v0.45.1) for all available downloads.

| OS     | Arch    | Bundle                                     |
| ------ | ------- | ------------------------------------------ |
| Linux  | x86-64  | `cerbosctl_0.45.1_Linux_x86_64.tar.gz`    |
| Linux  | arm64   | `cerbosctl_0.45.1_Linux_arm64.tar.gz`     |
| MacOS  | universal| `cerbosctl_0.45.1_Darwin_all.tar.gz`      |
| MacOS  | x86-64  | `cerbosctl_0.45.1_Darwin_x86_64.tar.gz`   |
| MacOS  | arm64   | `cerbosctl_0.45.1_Darwin_arm64.tar.gz`    |

You can download the binaries by running the following command. Substitute `<BUNDLE>` with the appropriate value from the above table.

```sh
curl -L -o cerbosctl.tar.gz "https://github.com/cerbos/cerbos/releases/download/v0.45.1/<BUNDLE>"
tar xvf cerbosctl.tar.gz
chmod +x cerbosctl
mv cerbosctl /usr/local/bin/ # or somewhere on your PATH
```

|     |     |
| --- | --- |
|  | Cerbos binaries are signed using [sigstore](https://www.sigstore.dev/) tools during the automated build process and the verification bundle is published along with the binary as `<BUNDLE>.bundle`.<br>The following example demonstrates how to verify the Linux X86_64 bundle archive.<br>```sh<br># Download the bundle archive<br>curl -L \<br>  -o cerbosctl_0.45.1_Linux_x86_64.tar.gz \<br>  "https://github.com/cerbos/cerbos/releases/download/v0.45.1/cerbosctl_0.45.1_Linux_x86_64.tar.gz"<br># Download the verification bundle<br>curl -L \<br>  -o cerbosctl_0.45.1_Linux_x86_64.tar.gz.bundle \<br>  "https://github.com/cerbos/cerbos/releases/download/v0.45.1/cerbosctl_0.45.1_Linux_x86_64.tar.gz.bundle"<br># Verify the signature<br>cosign verify-blob \<br>  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \<br>  --certificate-identity="https://github.com/cerbos/cerbos/.github/workflows/release.yaml@refs/tags/v0.45.1" \<br>  --bundle="cerbosctl_0.45.1_Linux_x86_64.tar.gz.bundle" \<br>  "cerbosctl_0.45.1_Linux_x86_64.tar.gz"<br>```<br> |

## Usage

The `cerbosctl` CLI tool can be used to upload policies to a policy store in Cerbos Hub.

First generate a set of client credentials for the policy store in Cerbos Hub - you can do this in the **Client credentials** section in the UI. Make sure to select the `Read & Write` option when creating the credentials to allow uploading policies.

Then export the following environment variables with the values from the generated client credentials and the store ID:

```sh
export CERBOS_HUB_CLIENT_ID=...
export CERBOS_HUB_CLIENT_SECRET=...
export CERBOS_HUB_STORE_ID=...
```

The following command uploads policy files from the current directory and replaces all the files in the store.

```sh
cerbosctl hub store replace-files .
```

## Full CLI Reference

```none
Usage: cerbosctl hub store --store-id=STRING --client-id=STRING --client-secret=STRING <command> [flags]

Interact with Cerbos Hub managed stores.

Requires an existing managed store and the API credentials to access it. The store ID and credentials can be provided using either command-line flags or
environment variables.

Flags:
  -h, --help                    Show context-sensitive help.

--store-id=STRING         ID of the store to operate on ($CERBOS_HUB_STORE_ID)
      --client-id=STRING        Client ID of the access credential ($CERBOS_HUB_CLIENT_ID)
      --client-secret=STRING    Client secret of the access credential ($CERBOS_HUB_CLIENT_SECRET)

Commands:
  hub store list-files --store-id=STRING --client-id=STRING --client-secret=STRING [flags]
    List store files

hub store get-files --store-id=STRING --client-id=STRING --client-secret=STRING --output-path=STRING <files> ... [flags]
    Download files from the store

hub store download --store-id=STRING --client-id=STRING --client-secret=STRING <output-path> [flags]
    Download the entire store

hub store replace-files --store-id=STRING --client-id=STRING --client-secret=STRING <path> [flags]
    Overwrite the store with the given set of files

hub store add-files --store-id=STRING --client-id=STRING --client-secret=STRING <paths> ... [flags]
    Add files to the store

hub store delete-files --store-id=STRING --client-id=STRING --client-secret=STRING <paths> ... [flags]
    Delete files from the store
```