Installation

nur is an end-user command-line tool, not a library, so install it as a standalone application rather than as a project dependency. It ships a single nur command that launches both the CLI and the TUI.

Stable release

Install nur into an isolated environment with your preferred tool installer:

uv tool install nur

pipx install nur

Or run it without installing:

uvx nur

On macOS/Linux, install it from the Homebrew tap:

brew install hasansezertasan/tap/nur

On Windows, install it from the Scoop bucket:

scoop bucket add hasansezertasan https://github.com/hasansezertasan/scoop-bucket
scoop install nur

Verify release provenance

The release workflow uses two complementary attestation mechanisms:

• GitHub build attestations record SLSA provenance for distributions when they are built, including workflow and source information. Their Sigstore bundles are also attached to the GitHub Release.

• PyPI publication attestations identify the Trusted Publisher that uploaded each distribution. The publishing action enables these by default for Trusted Publishing to PyPI or TestPyPI. They are available through PyPI’s per-file provenance APIs and UI, rather than as GitHub release bundles.

The publication claim does not replace the structured build-provenance claim. Both refer to the distribution bytes transferred from the build job, without an intervening rebuild. See PyPI’s attestation documentation for the index-hosted publication claim.

After downloading a wheel or source distribution, verify its GitHub build attestation against this repository’s release workflow and main ref:

gh attestation verify <downloaded-distribution> \
  --repo hasansezertasan/nur \
  --signer-workflow hasansezertasan/nur/.github/workflows/release.yml \
  --source-ref refs/heads/main

To use the matching provenance bundle downloaded from the GitHub Release instead of fetching the attestation from GitHub’s API, add --bundle:

gh attestation verify <downloaded-distribution> \
  --bundle <downloaded-provenance-bundle> \
  --repo hasansezertasan/nur \
  --signer-workflow hasansezertasan/nur/.github/workflows/release.yml \
  --source-ref refs/heads/main

Fully offline verification also needs trusted-root material; see GitHub’s offline verification guide.

GitHub build attestations are available for public repositories on current GitHub plans. Private and internal repositories require GitHub Enterprise Cloud and the repository variable ENABLE_PRIVATE_ATTESTATIONS=true. This opt-in applies to GitHub build attestations, not PyPI’s publication attestations. PyPI’s default attestation path requires Trusted Publishing and uses public Sigstore infrastructure; publication with an API token or an explicit attestation opt-out does not generate those attestations automatically.

From source

The source files for nur can be downloaded from the GitHub repo.

You can either clone the public repository:

git clone https://github.com/hasansezertasan/nur.git

Or download the tarball:

mkdir nur
curl -fL https://github.com/hasansezertasan/nur/tarball/main | tar -xz --strip-components=1 -C nur

Once you have a copy of the source, you can install it with:

cd nur
uv tool install .