BaudBound releases currently target 64-bit Windows and 64-bit x86 Linux. Windows uses an installer. Debian and Ubuntu use a .deb package. Fedora uses an .rpm package. A portable AppImage is also published for manual use on other compatible Linux systems.
Download release files only from the BaudBound GitHub Releases page. Open the latest published release and choose the file for the operating system. You do not need Rust, Node.js, or the source repository to run a published release.
BaudBound encrypts script secret values before storing them. On Linux, the desktop application requires a service that implements the standard Secret Service interface.
Most GNOME desktop installations use GNOME Keyring. Other desktop environments may provide a compatible service through KWallet or another credential manager.
The BaudBound installer does not install a credential manager automatically. The correct provider depends on the Linux desktop environment, and installing multiple providers can create conflicts.
BaudBound connects to Secret Service in the background. The desktop window and scripts that do not use secrets remain available while the connection is being established. Scripts that require secrets cannot use those values until the connection succeeds.
The Security page shows whether the credential vault is connecting, available, or unavailable. When a connection fails, the page displays the error and provides a Retry button. BaudBound never replaces the credential vault with an unencrypted key file.
Install GNOME Keyring, its login integration, and the testing tool:
sudo apt install gnome-keyring libpam-gnome-keyring libsecret-tools
Restart the machine or sign out of the graphical desktop and sign back in. This allows the login session to start and unlock the credential vault.
sudo dnf install gnome-keyring libsecret
Restart the machine or sign out of the graphical desktop and sign back in.
sudo pacman -S gnome-keyring libsecret
Restart the machine or sign out of the graphical desktop and sign back in.
Run this command from the same desktop session that will run BaudBound:
busctl --user list | grep org.freedesktop.secrets
A working service displays a process ID and the credential manager process. A result containing only activatable means the service is installed but is not currently running.
You can test encrypted storage with:
printf 'baudbound-test' | secret-tool store --label='BaudBound test' application baudbound-test
Remove the test value afterward:
secret-tool clear application baudbound-test
Remote desktop and VNC sessions may have a separate desktop session. The Secret Service must be running inside the same user session as BaudBound. A credential vault that works during a local login might not automatically start inside a VNC session.
Headless services do not use the desktop credential vault. They use the protected BAUDBOUND_SECRET_KEY environment value described in Secrets.
These commands install BaudBound when it is missing and update it when an older version is installed. The downloaded release file is checked against the SHA-256 digest published by GitHub before it is opened or installed.
This is the recommended method for most users. Choose the operating system below and run its single command.
A SHA-256 digest is a long value calculated from a file. It works like a digital fingerprint. The installation script calculates the fingerprint of the downloaded file and compares it with the fingerprint published for that release. The script stops when they do not match.
Open PowerShell and run:
irm https://get.baudbound.app/windows | iex
The script downloads the current Windows installer from the official BaudBound GitHub release and verifies it before opening the normal setup window. Quit BaudBound before running the command when you are updating an existing installation.
Open a terminal and run:
curl -fsSL https://get.baudbound.app/linux | sh
The command above uses curl to download the installer, so curl must already be available. If the terminal says that curl was not found, install it with the command for your distribution and then run the BaudBound installation command again.
On Debian or Ubuntu, install curl with:
sudo apt install curl
On Fedora, install curl with:
sudo dnf install curl
After curl starts the installer, the script confirms that the machine uses 64-bit x86 Linux and reads the distribution information from /etc/os-release. Debian and Ubuntu receive the .deb package through APT. Fedora receives the .rpm package through DNF.
The script checks every command it needs before downloading BaudBound. If a command is missing, the script stops and names it. It also stops without downloading anything when the distribution or architecture is unsupported.
The selected package is downloaded from the official GitHub Release. Its SHA-256 digest, package name, version, and architecture are checked before APT or DNF starts. The package manager asks for administrator approval and installs the command, application-menu launcher, and icons.
The automatic installer does not install the AppImage. On an unsupported distribution, follow the portable AppImage instructions below.
The installer refuses to replace a newer installed version with an older GitHub Release. It stops before APT or DNF starts and leaves the current installation unchanged.
If the old per-user AppImage installation is detected, the installer stops instead of creating duplicate commands or application-menu entries. Follow Switching from AppImage to a native package first.
Use this section when you do not want to run the hosted installation script. These steps download and install the same official GitHub release files manually.
Manual installation takes more steps and requires you to replace files yourself when updating. Use it only when you prefer not to run the automatic installation command.
.exe setup file from the latest published release on the BaudBound GitHub Releases page.The desktop interface uses Microsoft Edge WebView2. It is already installed on current Windows systems. If the application reports that WebView2 is missing, install the current WebView2 Runtime from Microsoft and launch BaudBound again.
The installer provides the desktop application. It does not guarantee that baudbound is added to every terminal's PATH. Use the Start menu for normal desktop use. CLI users can run the installed executable directly or add its installation directory to PATH themselves.
Use the native package for Debian, Ubuntu, or Fedora. It installs the desktop launcher and the baudbound command through the operating system package manager.
_amd64.deb.cd "$HOME/Downloads"
ls -1 Baudbound_*_amd64.deb
sudo apt install ./Baudbound_*_amd64.deb
APT installs a newer package over an older BaudBound version. You do not need to remove the old version first.
.x86_64.rpm.cd "$HOME/Downloads"
ls -1 Baudbound-*.x86_64.rpm
sudo dnf install ./Baudbound-*.x86_64.rpm
DNF installs a newer package over an older BaudBound version. You do not need to remove the old version first.
Use the AppImage when the automatic installer does not support the distribution or when you specifically want a portable per-user installation. The AppImage is available only from the GitHub Releases page. It is not offered by get.baudbound.app.
The AppImage contains both the BaudBound desktop application and its CLI. Starting it without a command opens the desktop application. Adding a command such as --version or doctor uses the CLI.
The application menu launcher does not need special arguments. baudbound --gui is available when you need to request the graphical application explicitly from a terminal. The --autostart flag is reserved for the login entry created by BaudBound and should not be added to a normal launcher.
The steps below install BaudBound only for your user account. They do not install a system package and do not require sudo.
Download the .AppImage from the latest published release on the BaudBound GitHub Releases page.
Open a terminal. Move into the Downloads directory because this is where most browsers save the file:
cd "$HOME/Downloads"
ls -1 Baudbound_*.AppImage
Exactly one filename should be printed. If several files are printed, move the older files elsewhere or replace Baudbound_*.AppImage in the later copy command with the exact filename you want to install.
mkdir -p "$HOME/.local/opt/baudbound"
cp Baudbound_*.AppImage "$HOME/.local/opt/baudbound/BaudBound.AppImage"
chmod 0755 "$HOME/.local/opt/baudbound/BaudBound.AppImage"
mkdir -p "$HOME/.local/bin"
baudbound. This lets you type baudbound instead of the full AppImage path:ln -sfn "$HOME/.local/opt/baudbound/BaudBound.AppImage" "$HOME/.local/bin/baudbound"
The link remains unchanged when the AppImage is updated. Tauri's updater resolves the link to the real file and replaces ~/.local/opt/baudbound/BaudBound.AppImage. See the AppImage documentation for the APPIMAGE and ARGV0 behavior.
baudbound command:command -v baudbound
The result should end with .local/bin/baudbound. If nothing is printed, add the following line to ~/.profile. This tells new terminal sessions to search your per-user command directory:
export PATH="$HOME/.local/bin:$PATH"
Sign out and back in after changing ~/.profile.
baudbound --version
The following steps add BaudBound to the desktop application menu with its own icon. The launcher opens the graphical application without opening a terminal window.
mkdir -p "$HOME/.local/share/applications"
mkdir -p "$HOME/.local/share/icons/hicolor/128x128/apps"
desktop_assets_dir="$(mktemp -d)"
cd "$desktop_assets_dir"
"$HOME/.local/opt/baudbound/BaudBound.AppImage" --appimage-extract >/dev/null
cp -L "$desktop_assets_dir/squashfs-root/.DirIcon" "$HOME/.local/share/icons/hicolor/128x128/apps/baudbound.png"
cd "$HOME/Downloads"
rm -rf "$desktop_assets_dir"
$HOME to your real home directory:cat > "$HOME/.local/share/applications/app.baudbound.runner.desktop" <<EOF
[Desktop Entry]
Version=1.0
Type=Application
Name=BaudBound
Comment=Visual automation runner
Exec=$HOME/.local/opt/baudbound/BaudBound.AppImage
Icon=baudbound
Terminal=false
Categories=Utility;
StartupNotify=true
EOF
Terminal=false tells the desktop environment to open only the BaudBound window. The launcher should appear in the application menu after a short delay. Sign out and back in if the menu does not refresh. You can pin BaudBound to the taskbar, dock, or favorites from that menu.
Many Linux desktops do not show files or launchers directly on the desktop. Skip this section when your desktop does not support desktop icons. The application menu launcher created above will still work.
xdg-user-dir is installed. This command finds the correct desktop directory even when it has a localized name:command -v xdg-user-dir
If the command prints nothing, use the application menu launcher instead.
desktop_dir="$(xdg-user-dir DESKTOP)"
cp "$HOME/.local/share/applications/app.baudbound.runner.desktop" "$desktop_dir/BaudBound.desktop"
chmod 0755 "$desktop_dir/BaudBound.desktop"
Some desktop environments show an Allow Launching action the first time you use a new desktop launcher. Choose that action if it appears.
Open the application menu and choose BaudBound. The Dashboard should open without a terminal window. You can also open it from a terminal with this command:
baudbound
The terminal remains connected until you quit BaudBound when you start it this way. Use the application menu launcher for normal desktop use.
If the AppImage reports a FUSE error, use the matching distribution tab in Linux FUSE packages. If baudbound --version works, no additional FUSE package is needed.
AppImage compatibility depends on the host architecture, graphics session, and system libraries. Verify it on the intended machine before relying on it.
AppImages are portable executables and are not installed through the system package database. To run BaudBound continuously without the desktop application, follow Linux Background Service.
Refresh the package information so apt knows which versions are currently available:
sudo apt update
Check which FUSE 2 runtime your distribution provides:
apt-cache policy libfuse2t64 libfuse2
Install the package whose Candidate line shows a version instead of (none). Ubuntu 24.04 and newer normally use:
sudo apt install -y libfuse2t64
Debian and older Ubuntu releases normally use:
sudo apt install -y libfuse2
Install only one. If neither package has a candidate, confirm that the standard distribution repositories are enabled.
sudo dnf install -y fuse-libs
Perform a full system upgrade while installing FUSE 2 because Arch does not support partial upgrades:
sudo pacman -Syu --needed fuse2
sudo emerge --ask sys-fs/fuse:0
The AppImage supports Void's 64-bit glibc edition, not its musl edition:
sudo xbps-install -S fuse
These package names follow the AppImage project's FUSE troubleshooting guidance and the distributions' package documentation.
Use this section only when the AppImage reports a FUSE error.
The native package and AppImage use the same runner data directory, so scripts and configuration do not need to be moved. The old AppImage command and launcher must be removed to avoid opening the wrong copy.
rm -f "$HOME/.local/opt/baudbound/BaudBound.AppImage"
rm -f "$HOME/.local/bin/baudbound"
rm -f "$HOME/.local/share/applications/baudbound.desktop"
rm -f "$HOME/.local/share/applications/app.baudbound.runner.desktop"
rm -f "$HOME/.config/autostart/BaudBound.desktop"
These commands remove only the old application files and launchers. They do not delete installed scripts, configuration, secrets, logs, or run history. Run the automatic installer after cleanup.
The application command and native package database identifier are both baudbound.
On Debian or Ubuntu, remove the application files owned by APT with:
sudo apt remove baudbound
On Fedora, remove the application files owned by DNF with:
sudo dnf remove baudbound
Package removal leaves the runner data in your user profile. This protects scripts, configuration, secrets, logs, and run history when reinstalling. Delete that data separately only when you intentionally want a complete cleanup.
The first launch creates the runner home and a default config.toml automatically. You do not need to run baudbound config init for a normal desktop installation.
Open Doctor in the desktop navigation. A successful check confirms that the configuration and runner storage are accessible and shows which native actions the current machine supports.
Print the installed version to confirm which release is running:
baudbound --version
Run the built-in checks for configuration, storage, and supported native features:
baudbound doctor
Print the configuration file path when you need to find or back up the active settings:
baudbound config path
The desktop updater can install updates for the Windows installer and portable Linux AppImage.
The AppImage must remain writable by the current user. The per-user installation above satisfies that requirement. Do not change its owner to root.
BaudBound can check for a newer release from a .deb or .rpm installation, but it does not replace files owned by APT or DNF. The update dialog and About page therefore show release notes, a link to the latest GitHub Release, and the hosted installer command. They do not show Download update or Restart and install.
Before updating, stop active runs from the Runs page. Stop the desktop background runner from the Service page. Open the tray menu and choose Quit. Closing only the window may leave BaudBound running in the tray.
Run the same command used for installation:
curl -fsSL https://get.baudbound.app/linux | sh
The script detects the distribution again and asks APT or DNF to upgrade the installed package. The package manager requests administrator approval. Open BaudBound normally after the command completes.
You can also download the newer native package manually and run the same apt install or dnf install command shown in Manual installation.
APT and DNF cannot discover BaudBound updates during a normal system upgrade because BaudBound does not yet provide a package repository. Rerun the hosted command or install the newer downloaded package.
Use these steps only for an AppImage installation when the update dialog cannot complete the update.
baudbound serve in a terminal: Press Ctrl+C in that terminal and wait for the process to exit.sudo systemctl stop baudbound and confirm sudo systemctl status baudbound reports it as inactive.sudo rc-service baudbound stop and confirm sudo rc-service baudbound status reports it as stopped.sudo sv down baudbound and confirm sudo sv status baudbound reports it as down.pgrep -af 'BaudBound|baudbound'
No output means BaudBound has stopped. If a process is listed, return to the application or service manager and stop it normally before continuing.
~/Downloads/BaudBound.AppImage using one of these download options.Option A: Web browser
Open the latest published release on the BaudBound GitHub Releases page. Download its .AppImage file, move it to ~/Downloads if necessary, and rename the downloaded file to BaudBound.AppImage.
Option B: Terminal with curl
This option requires curl and jq. First, check that curl is installed. It downloads release information and the AppImage:
command -v curl
Check that jq is installed. It safely reads the AppImage URL from GitHub's structured release information:
command -v jq
Both commands must print a path. If either prints nothing, install that command with the distribution's package manager or use the web browser option.
Fetch the AppImage URL from GitHub's latest published release and store it in APPIMAGE_DOWNLOAD_URL:
APPIMAGE_DOWNLOAD_URL="$(curl --fail --silent --show-error "https://api.github.com/repos/BaudBound/baudbound/releases/latest" | jq -er '.assets | map(select(.name | endswith(".AppImage"))) | if length == 1 then .[0].browser_download_url else error("expected exactly one AppImage asset") end')"
Print the stored URL so you can confirm that it points to the official BaudBound GitHub release:
printf '%s\n' "$APPIMAGE_DOWNLOAD_URL"
The printed URL must begin with https://github.com/BaudBound/baudbound/releases/download/ and end with .AppImage.
Create the Downloads directory if it does not already exist:
mkdir -p "$HOME/Downloads"
Download the AppImage to a predictable filename in that directory:
curl --fail --location --output "$HOME/Downloads/BaudBound.AppImage" "$APPIMAGE_DOWNLOAD_URL"
If the API is unavailable, rate-limited, or does not contain exactly one AppImage, the URL command fails instead of choosing an arbitrary asset. Use the web browser option in that case. A failed download leaves the current installation unchanged.
After completing either option, continue with step 4. Both options produce the same ~/Downloads/BaudBound.AppImage file used by the remaining update steps.
ls -lh "$HOME/Downloads/BaudBound.AppImage"
cp "$HOME/Downloads/BaudBound.AppImage" "$HOME/.local/opt/baudbound/BaudBound.AppImage"
Restore its executable permission because downloaded files may not keep that permission:
chmod 0755 "$HOME/.local/opt/baudbound/BaudBound.AppImage"
baudbound --version
The command must print the intended new version. The baudbound symlink does not change because it still points to the stable installed path.
baudbound.baudbound serve.sudo systemctl start baudbound and check sudo systemctl status baudbound.sudo rc-service baudbound start and check sudo rc-service baudbound status.sudo sv up baudbound and check sudo sv status baudbound.Manual replacement does not use Tauri's automatic signature-verification flow, so download only from the official GitHub Releases page. See Linux Background Service for service setup and control commands.
Continue with Script Management.