Key Management CLI — Downloads

Package: AnkaSecure Key Management CLI
Binary: ankasecure-km
Version: 3.4.0
Java required: 25+ (bundled in installer media)

The Key Management CLI is distributed as a single binary per platform. Each installer ships with a bundled Java 25 runtime; a separate JDK is only required if you choose the portable fat JAR.

Windows installers

Executable wizard (recommended)

Architecture	Download	Description
Windows x64	ANKASecureKeyManagementCLI_windows-x64_3_4_0.exe	Guided wizard installer

Features

Guided installation wizard.
Default install path: C:\AnkaTech\ANKASecureKeyManagementCLI\.
Start-menu shortcut.
Uninstaller included.
Bundled Java 25 runtime — no separate JDK installation required.

Portable ZIP

Architecture	Download	Description
Windows x64	ANKASecureKeyManagementCLI_windows-x64_3_4_0.zip	Extract and run; no installer

Features

No installation required.
Extract to any directory.
Manual PATH integration.
Bundled Java 25 runtime.

macOS installer

DMG (Universal)

Architecture	Download	Description
macOS Universal	ANKASecureKeyManagementCLI_macos_3_4_0.dmg	Intel + Apple Silicon universal binary

Features

Universal binary (runs natively on Intel and Apple Silicon).
Drag-and-drop installation to /Applications/.
Bundled Java 25 runtime.

Installation steps

Double-click the .dmg to mount the image.
Drag ANKASecureKeyManagementCLI into /Applications/.
Eject the disk image.

Opening the app the first time on macOS

The macOS installer is not signed or notarized with an Apple Developer ID, so macOS blocks the first launch of ankasecure-km. To allow it, try to open it once, then choose Apple menu > System Settings > Privacy & Security, click Open Anyway under Security and confirm with your login password. The button is available for about an hour after the blocked launch. Apple describes the steps in Open a Mac app from an unknown developer.

Linux installers

Debian / Ubuntu package

Architecture	Download	Description
Debian / Ubuntu	ANKASecureKeyManagementCLI_linux_3_4_0.deb	For Debian-based distributions

Features

System package manager integration.
Installation path: /srv/anka-secure/ANKASecureKeyManagementCLI/.
Symlink at /usr/local/bin/ankasecure-km.
Bundled Java 25 runtime.

Installation

sudo dpkg -i ANKASecureKeyManagementCLI_linux_3_4_0.deb
ankasecure-km --version

Universal shell installer

Architecture	Download	Description
Any Linux / Unix	ANKASecureKeyManagementCLI_unix_3_4_0.sh	Works on any distribution

Features

Interactive installation wizard.
Configurable install directory + optional PATH integration.
Bundled Java 25 runtime.

Installation

chmod +x ANKASecureKeyManagementCLI_unix_3_4_0.sh
./ANKASecureKeyManagementCLI_unix_3_4_0.sh

Portable fat JAR

Artifact	Description
`ankasecure-cli-key-management-3.4.0-fat.jar`	Portable shaded JAR; requires a working JDK 25 on the host

java -jar ankasecure-cli-key-management-3.4.0-fat.jar --version

The fat JAR is the same artifact that drives all of the platform installers — they bundle it together with a runtime. Use the fat JAR directly when you cannot install OS-specific media (CI containers, ephemeral build agents, locked-down systems).

Installer selection guide

Platform	Recommended	Alternative
Windows 10 / 11 (x64)	`.exe` wizard	`.zip` portable
macOS (Intel + Apple Silicon)	`.dmg` (Universal)	Portable fat JAR
Ubuntu / Debian / Mint	`.deb`	`.sh` universal
RHEL / CentOS / Fedora	`.sh` universal	Portable fat JAR
Other Linux / Unix	`.sh` universal	Portable fat JAR
CI / containerised builds	Portable fat JAR	—

Total installer media available: 5 (Windows EXE, Windows ZIP, macOS DMG, Linux DEB, Universal Linux SH) plus the portable fat JAR.

File integrity verification

Checksum files

Download in the browser you are already signed in with

You reached this page through your own sign-in, so the links above and the checksum links below work with a click and no credential of any kind. Save both the installer and sha256sums from the browser, then verify locally with the commands below.

A plain curl from a terminal is not signed in. It receives a sign-in redirect, writes that HTML page to disk under the filename you asked for, and exits 0 — after which the digest comparison says MISMATCH and reads as a corrupted download. If you need a terminal-side download, use cloudflared access curl <url>, which performs the same per-person sign-in in your browser and then fetches the file as you. There is no shared account and no client-id/secret pair to ask anyone for.

Windows (PowerShell)

# Run this in the directory where the browser saved both files.
$hash = (Get-FileHash "ANKASecureKeyManagementCLI_windows-x64_3_4_0.exe" -Algorithm SHA256).Hash.ToLower()
Select-String -Path sha256sums -Pattern $hash

Linux / macOS

# Run this in the directory where the browser saved both files.
# macOS has no sha256sum: use `shasum -a 256 -c` there.
sha256sum -c sha256sums --ignore-missing

Past releases

Every published version keeps its own permanent path, /downloads/key-management-cli/<X.Y.Z>/, and its files are never replaced or removed. The links on this page name the release this documentation version was built from; the version selector at the top of the page opens another version's page.

Every published version of the Key Management CLI — newest first, each version with its files and their SHA-256 checksums.
/downloads/key-management-cli/latest/<file> redirects to <file> in the greatest published version, and /downloads/key-management-cli/latest/ to that version's entry in the listing. File names carry their version, so a script that must always fetch the newest release reads the component's latest from the releases index below and then fetches the versioned path; a reproducible installation pins a version instead.
/downloads/releases.v1.json is the machine-readable index of every version of every component this site publishes (schemaVersion 1; per file its name, size and SHA-256).

Releases before the Key Management CLI were published as the Admin CLI (/downloads/admin-cli/). Those downloads stay where they are; no later release is published under that name.

Post-download steps

Verify integrity — compare the downloaded file's SHA-256 against the published checksum.
Install — follow the Installation Guide.
Verify installation — ankasecure-km --version should print the version in the installer's file name.

Initialize with the tenant's administrative workload:

ankasecure-km init --url https://api.example.com --workload-id <WORKLOAD_UUID> --private-key-file /etc/acme/workload-key.pem

Read the docs:

CLI Version: 3.4.0
Java required: 25+
Server API compatibility: AnkaSecure Admin API 3.4.0+ and Auth API 3.4.0+ (Key Management SDK — Compatibility with newer servers)