Key Management CLI — Installation

Package: AnkaSecure Key Management CLI
Binary: ankasecure-km (fat JAR: ankasecure-cli-key-management-3.4.0-fat.jar)
Version: 3.4.0
Java required: 25+ (bundled in installer media; standalone fat JAR requires a separate JDK 25)

The Key Management CLI is shipped as a single installer per platform plus a portable fat JAR. Both deliver the same ankasecure-km binary — the installer media bundles a Java 25 runtime, while the fat JAR is launched with the host JDK.

Table of contents

1. Choosing the right media
2. Installation per platform
3. Installation paths
4. Configuration storage
5. First run with init
6. Verification
7. Upgrades
8. Uninstall

1. Choosing the right media

All media are listed on the Downloads page with SHA-256 checksums.

2. Installation per platform

Windows — wizard installer

1. Download ANKASecureKeyManagementCLI_windows-x64_3_4_0.exe.
2. Verify the checksum (PowerShell):

   Get-FileHash -Algorithm SHA256 ANKASecureKeyManagementCLI_windows-x64_3_4_0.exe
   # Compare to the value published on the Downloads page
   

3. Run the installer. Default install path: C:\AnkaTech\ANKASecureKeyManagementCLI\.
4. The installer creates a Start-menu shortcut and adds the binary to PATH.

Windows — portable ZIP

1. Download ANKASecureKeyManagementCLI_windows-x64_3_4_0.zip.
2. Extract to a directory of your choice.
3. Add the extracted directory to your PATH manually (no installer-driven PATH update).
4. Run ankasecure-km.exe --version from any shell to verify.

macOS — DMG (Universal)

1. Download ANKASecureKeyManagementCLI_macos_3_4_0.dmg.
2. Double-click the DMG to mount it.
3. Drag ANKASecureKeyManagementCLI into /Applications.
4. Open Terminal and run:

   /Applications/ANKASecureKeyManagementCLI.app/Contents/MacOS/ankasecure-km --version
   

   Optionally symlink into your PATH:

   ln -s /Applications/ANKASecureKeyManagementCLI.app/Contents/MacOS/ankasecure-km /usr/local/bin/ankasecure-km
   

Linux — Debian package

sudo dpkg -i ANKASecureKeyManagementCLI_linux_3_4_0.deb
ankasecure-km --version

Installation path: /srv/anka-secure/ANKASecureKeyManagementCLI/. The package registers the binary in /usr/local/bin/ankasecure-km.

Linux — universal shell installer

chmod +x ANKASecureKeyManagementCLI_unix_3_4_0.sh
./ANKASecureKeyManagementCLI_unix_3_4_0.sh

The installer is interactive and prompts for the install directory and PATH integration.

Any platform — portable fat JAR

Requires a working JDK 25 on the host:

java -jar ankasecure-cli-key-management-3.4.0-fat.jar --version

For automation, wrap it in a shell alias or PowerShell function:

alias ankasecure-km='java -jar /path/to/ankasecure-cli-key-management-3.4.0-fat.jar'

3. Installation paths

4. Configuration storage

The config file is config.properties inside that directory. It holds the deployment's address, the workload id and a reference to the credential — the private key file's path, the token file's path or the token command — never a key, token or secret. Tokens live in memory only, for the duration of one command.

• The directory the CLI creates is 0700 and the file 0600 on POSIX; on Windows each gets an access list granting the owning account (and NT AUTHORITY\SYSTEM) only. A restriction that cannot be applied fails the write (E_CONFIG_WRITE, exit 4).
• Every save writes a temporary owner-only file in the same directory and moves it into place atomically.

Overriding the config directory

The configuration directory is taken from the JVM system property ankasecure.km.config.dir, then from the ANKASECURE_KM_CONFIG environment variable, then the default above; config.properties is read inside it.

export ANKASECURE_KM_CONFIG=/path/to/custom-config-dir
ankasecure-km view-session

5. First run with init

The CLI signs in as an administrative workload^* of the tenant, with exactly one credential reference:

# a private key file (PKCS#8 PEM or private JWK), readable by its owner only
ankasecure-km init --url https://api.example.com --workload-id <WORKLOAD_UUID> --private-key-file /etc/acme/workload-key.pem

# a token file a platform keeps fresh (for example a projected service-account token)
ankasecure-km init --url https://api.example.com --workload-id <WORKLOAD_UUID> --token-file /var/run/secrets/tokens/ankasecure

# a command that prints a federated token; runs only with the opt-in variable set
ANKASECURE_ALLOW_EXTERNAL_TOKEN_COMMAND=1 ankasecure-km init --url https://api.example.com \
    --workload-id <WORKLOAD_UUID> --token-command "gcloud auth print-identity-token --audiences=https://api.example.com/api"

None or two of --private-key-file, --token-file and --token-command is a usage error (exit 2). init authenticates once before it writes anything, so a wrong id or key is reported at once. There is no person sign-in, no --tenant and no context: the workload's token names its tenant.

Development with self-signed TLS

ankasecure-km init --url https://dev.example.com --workload-id <WORKLOAD_UUID> --private-key-file ./workload-key.pem --insecure

--insecure is persisted: every later command prints a warning on stderr. Re-run init without it to revert.

6. Verification

ankasecure-km --version
ankasecure-km --help            # lists the command groups
ankasecure-km view-session      # workload, tenant, token expiry, scopes; never the token
ankasecure-km keys list

7. Upgrades

Windows wizard / macOS DMG / Linux .deb

Run the new installer on top of the existing installation. Configuration in ~/.ankasecure-km/ is preserved.

Portable ZIP / .sh installer

Extract the new media to the same directory or replace the binary path. Verify with ankasecure-km --version after replacement.

Portable fat JAR

Replace the .jar file. The configuration directory is unchanged.

8. Uninstall

Removing the binary does not delete ~/.ankasecure-km/. Delete the directory to remove the stored configuration; it holds no secret, but it names the workload and its key file.

Related documentation

• Key Management CLI Overview
• Downloads
• Commands Reference
• Usage Examples
• CLI Tools Overview^*

CLI Version: 3.4.0
Java Version: 25

© 2026 ANKATech Solutions Inc. All rights reserved.