Xygeni User Guides
  • Welcome to Xygeni
  • Getting Started
    • Create a Free Trial Account
    • Quick start with your code repository
    • Quick start with Xygeni CLI
    • Quick start with a preloaded project
    • Log in to Xygeni
    • Subscribe to Xygeni
  • Introduction to Xygeni
    • Key Concepts
      • Projects in Xygeni
      • Project Baseline
      • Detected Issues
      • Remediation Actions
      • Policies
      • Risk Level
      • SDLC Inventory
      • Standards Compliance
      • GuardRails
    • Xygeni Products
    • How Xygeni works
    • Xygeni Web UI Overview
      • Projects Screen
        • Risk Level
    • Integrating Xygeni into your Workflow
    • Prioritization Funnels
      • Custom Funnels
      • Prioritization Criteria (Stages)
        • Reachability
        • Exploitability
        • Fixable
    • Guardrails
    • Generate a SBOM
    • Reports
      • Trends
      • Scan History
    • Supported Integrations
    • Customizations
  • Xygeni Products
    • Application Security Posture Management (ASPM)
      • ASPM User Interface Guide
      • All Risks
        • Statistics
        • Issues Evolution
        • Issue Comparison Between Different Scans
      • Governance
      • Inventory
        • All Assets
        • Repositories
        • Components
        • CI/CD Assets
        • Delivery Assets
        • Systems & Tools
        • Collaborators
      • Health Check
      • Inventory Scanner
        • Inventory Scanner Configuration
        • Inventory Collaborators Scan
      • Importing reports from 3rd party tools
        • External Scanners Supported
          • Report upload for Kiuwan
            • ExportRule (.java)
    • Code Security (SAST)
      • Code Security (SAST) User Interface Guide
        • Risks (SAST)
        • Malicious Code
      • Malware Scanner
        • Malware Scanner Configuration
        • Malware Detectors
      • SAST Scanner
        • SAST Scanner Configuration
    • Open Source (SCA)
      • Open Source (SCA) User Interface Guide
      • Open Source Components
      • Supported Package Managers for dependency resolution
      • Risks (SCA)
      • OSS Prioritization Funnels
      • OSS Auto-Remediation
      • Malware Early Warning (MEW)
        • How Malware Early Warning works
        • Common types of Malware found in open source packages
      • Dependency Scanner
        • Dependency scanner configuration
        • Dependency Analyzers
      • Suspect Dependencies Scanner
        • Suspect Deps Scanner Configuration
        • Suspect Deps Detectors
    • CI/CD Security
      • CI/CD Security User Interface Guide
      • CI/CD Details
      • Build Attestations
      • CI/CD Scanner
        • CI/CD Misconfigurations Scanner Configuration
      • Compliance Scanner
        • Supported compliance standards
    • Secrets Security
      • Secrets User Interface Guide
      • Secrets Scanner
        • Secrets scanner configuration
      • Secret Leaks Handling
        • Secret Leaks Handling
        • How to Prevent Hard-Coded Secrets
        • Secret Leaks Handling CheatSheet
      • Secrets Auto-Remediation
    • IaC Security
      • IaC User Interface Guide
      • IaC Scanner
        • IaC Scanner Configuration
    • Malware
    • Build Security
      • Build Security Concepts
      • Build Attestations
      • Attestation format
      • How SALT works
      • Installing Salt CLI
      • Salt Command-Line Reference
      • SALT Architecture
      • SALT How To…​
    • Anomalous Activity Detection
      • Anomalous Activity Detection User Interface Guide
      • Xygeni Sensors
        • Xygeni Sensor for Azure
        • Xygeni Sensor for BitBucket
        • Xygeni Sensor for GitHub
          • GitHub Audit Log Processing
        • Xygeni Sensor for GitLab
        • Xygeni Sensor for Jenkins
        • Anomaly Detection's Detectors
      • Code Tampering Scanner
        • Code Tampering Scanner Configuration
    • Compliance & Malware Insights
      • SSCS Compliance
      • Malicious Packages DB
  • Scan Management
    • Manage Scans
    • Scan History
  • Xygeni Scanner CLI
    • Xygeni Scanners
    • Xygeni CLI Overview
      • Xygeni CLI Prerequisites
      • Xygeni CLI Installation
      • Xygeni CLI Docker Image
      • Xygeni CLI Authentication
        • CLI Authentication with Xygeni
      • SCM, CI/ CD and Container Registry tokens
      • Xygeni CLI Operation Modes
        • Single scan
          • Scanning a docker image
        • Multi Scan
        • Organization scan
      • Xygeni CLI Configuration options
      • Xygeni CLI Output Formats
      • Exporting Xygeni results to 3rd party tools
      • Automatic Remediation
      • Generate SBOM with the Xygeni CLI
      • CLI utils
        • Credentials Encryption
        • Central Configuration
      • Xygeni Guardrails
        • CI/CD Audit Analysis
      • Xygeni CLI Error Codes
      • Xygeni Scanner Reference
  • Xygeni Administration
    • Platform Administration
      • Profile
      • Subscription
      • Users Management
      • Projects Management
      • Groups Management
      • Policies
      • Integrations
        • Xygeni Single Sign-On (SSO) Authentication
          • SSO - OKTA
          • SSO - Microsoft Entra ID
        • Integrate Scanner CLI into CI/CD Systems
          • Azure Pipelines Integration
          • BitBucket Integration
          • CircleCI Integration
          • GitHub Actions Integration
          • GitLab Runner Integration
          • Jenkins Integration
          • Travis CI Integration
        • Git Hooks with Xygeni
        • Collaboration & communication Tools
        • Ticketing Systems
        • Remediation systems
      • Notifications
    • Rest API
  • Support
  • Changelog
    • Version 5.11 - April 11, 2025
    • Version 5.9 – March 26, 2025
Powered by GitBook
On this page
  • Installing Salt CLI
  • Download Salt CLI
  • Verify the Integrity
  • Unzip the CLI
  • Set Alias for Salt
  • Execute Salt
Export as PDF
  1. Xygeni Products
  2. Build Security

Installing Salt CLI

Installing Salt CLI

The Salt CLI is distributed as a zipfile that runs under Linux, macOS and Windows. The installation process downloads the zipfile, unzips the downloaded file, and adds a shortcut for running salt in the target platform.

In brief: Assuming that you want to place the Salt CLI in a given <TARGET_DIR> directory:

  • For macOS/Linux (bash):

      # download zipfile
      curl -sLO https://get.xygeni.io/latest/salt/salt.zip
      # verify integrity
      SALT_CHECKSUM=$(curl -s https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/salt.zip.sha256)
      echo "$SALT_CHECKSUM salt.zip" | sha256sum --check
      # unzip
      unzip salt.zip -d <TARGET_DIR>
      # add alias
      alias salt=<TARGET_DIR>/xygeni_salt/salt
    
      salt --help
  • For Windows (PowerShell):

  # download zipfile
  iwr https://get.xygeni.io/latest/salt/salt.zip -useb -OutFile salt.zip
  # verify integrity
  set salt_digest (iwr https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/salt.zip.sha256).Content
  (Get-FileHash '.\salt.zip' -Algorithm SHA256).Hash -eq $salt_digest
   # unzip
  Expand-Archive '.\salt.zip' -DestionationPath '<TARGET_DIR>'
  # Or, alternatively, for older PowerShell versions:
  # [System.IO.Compression.ZipFile]::ExtractToDirectory('.\salt.zip', '<TARGET_DIR>')
  # add alias
  Set-Alias -Name salt -Value <PATH_TO_SALT>\salt.ps1

  salt --help

The following sections describe in more detail each step.

Download Salt CLI

Run the one of the following which better matches your preferences:

  • For mac/Linux (bash):

      curl -sLO https://get.xygeni.io/latest/salt/salt.zip
  • On Windows (PowerShell):

      iwr https://get.xygeni.io/latest/salt/salt.zip -useb -OutFile salt.zip

Verify the Integrity

This GitHub repository website is hosted in a completely different platform from the download site. Hackers need to compromise two different sites to keep tampered components, like the scanner or the installation script, undetected by the checksum verification.

To ensure that the downloaded installation script checksum matches the checksum published in Xygeni repository, meaning that probably it was not tampered with:

  • On mac/Linux (bash):

    echo "$(curl -s https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/salt.zip.sha256) salt.zip" | sha256sum --check

    If under macOS, as sha256sum is probably not installed in your host, you may:

    (2) or use shasum -a 256 instead or sha256sum if the shasum command is installed,

    echo "$(curl -s https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/salt.zip.sha256) salt.zip" | sha256 -a 256 --check

  • On Windows (PowerShell):

    (Get-FileHash '.\salt.zip' -Algorithm SHA256).Hash -eq `
      (iwr https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/salt.zip.sha256)

Unzip the CLI

TARGET_DIR is the path where the zipfile contents will be extracted. Replace it with your

  • For mac/Linux (bash):

      unzip salt.zip -d <TARGET_DIR>
  • On Windows (PowerShell):

      Expand-Archive '.\salt.zip' -DestionationPath '<TARGET_DIR>'
      # Or, alternatively, for older PowerShell versions:
      # [System.IO.Compression.ZipFile]::ExtractToDirectory('.\salt.zip', '<TARGET_DIR>')

In what follows, the location of the Salt CLI is TARGET_DIR/xygeni_salt

Set Alias for Salt

The Salt CLI command is either a bash salt or PowerShell salt.ps1 script under TARGET_DIR/xygeni_salt. It is convenient to use an alias for running the command without providing its full path. You may add TARGET_DIR/xygeni_salt to the PATH, or alternatively add an alias or shell function:

  • For mac/Linux (bash):

      alias salt=<TARGET_DIR>/xygeni_salt/salt
  • On Windows (PowerShell):

      Set-Alias -Name salt -Value <PATH_TO_SALT>\salt.ps1

The salt CLI is now available for running using salt alias. Run salt --help to show the help for the different commands available.

You may add the --no-banner | -nb to the alias to hide the SALT banner, so logfiles are leaner: alias salt='<TARGET_DIR>/xygeni_salt/salt -nb'

Execute Salt

Once installed, you can execute salt.

Please note that you need to provide a Xygeni Token to salt to make it work.

PreviousHow SALT worksNextSalt Command-Line Reference

Last updated 28 days ago

Xygeni publishes a SHA-256 checksum of published components in the , so you may verify the integrity of a downloaded artifact.

(1) to install it,

Please see and for further information.

xygeni/xygeni GitHub repository
read this
Salt Command-Line Reference
Salt Authentication