Install

Check Requirements first — the floor is macOS 13 (Ventura) to run, macOS 15 (Sequoia) for every component at its current version, Windows 11 x64, or Ubuntu 22.04 LTS on x86_64 or arm64.

The three installs share almost nothing mechanically: a disk image and Gatekeeper, an unsigned installer and SmartScreen, a .deb and polkit; /etc/resolver, Windows’ NRPT and a dummy network link; a keychain, the CurrentUser Root store, and the system store plus every browser’s own. So each one is written out below rather than cross-referenced. Your own system’s tab is open already — the choice follows you across every page on this site.

macOS

One command (recommended)

curl -fsSL https://rexenv.rex.bd/install.sh | bash

It installs the latest release’s rexenv.app into Applications and opens it — after checking the download against the release’s own .sha256, and only if rexenv is not already installed. An installed copy is left alone and the script says where it is: rexenv updates itself, and a reinstall could put an older build over a newer one. The script is short;

read install.sh before you run it.

No Gatekeeper step, and nothing is bypassed to get there. Gatekeeper checks a file that carries the quarantine attribute, and the downloading app is what sets it: a browser does, curl does not. The script clears the attribute anyway — the same step the Homebrew cask runs — so both paths leave the same app behind. rexenv is still ad-hoc signed and not notarized: running the command is your decision to trust this source, exactly as trusting the tap is.

rex is not put on your PATH by the script: Settings → Command-line tool → Install does it, with one admin prompt.

Homebrew

1. Tap and install:

   brew tap rexenv/tap
   brew trust rexenv/tap
   brew install --cask rexenv

2. Launch it:

   open -a rexenv

`brew trust` is required, not optional

Current Homebrew refuses to install a cask from a tap it has not been told to trust. Skip that line and the install stops with a refusal that reads like a broken package.

Two things this path gives you that the disk image does not:

• No Gatekeeper step. The cask’s postflight removes the quarantine attribute, so the app opens on a normal double-click the first time.
• rex on your PATH automatically, linked into Homebrew’s bin. No Settings toggle needed.

Disk image

1. Download {release.dmg} from the releases page.

2. Download the .dmg.sha256 beside it, and verify:

   shasum -a 256 -c rexenv_*_universal.dmg.sha256

   It prints OK, or it tells you the file does not match. Checking with -c beats printing a hash and eyeballing it against another one — comparing 64 hex characters by eye is exactly the check people believe they performed.

3. Open the disk image, drag rexenv into Applications, eject.

4. Right-click (or Control-click) rexenv in Applications → Open → Open again in the dialog. Once only.

Why the right-click

rexenv is ad-hoc code-signed and not yet notarized by Apple, so Gatekeeper refuses a plain double-click the first time with “rexenv can’t be opened” or “unidentified developer”. The ad-hoc signature is what lets Apple Silicon run the app at all.

If you double-clicked first and got blocked, System Settings → Privacy & Security → scroll down → Open Anyway does the same thing. After once, rexenv opens normally forever.

The one-command install and the Homebrew path both avoid this entirely.

What happens on first launch

rexenv asks for permission three times — an admin password, a Keychain prompt, and an admin password again. They are expected, they all stay on your machine, and First run explains exactly what each one writes.

Where rexenv lives once it is open

rexenv is a menu-bar app: the crowned-R icon in your menu bar is its home, and it has no dock icon. Click the icon for the menu — the stack’s status, Start all and Stop all, your recent sites, About rexenv for the version and licences, and Open rexenv for the window. An open menu updates in place as the stack changes rather than closing on you; only a row appearing or disappearing — a site added, say — still forces macOS to close it. A dock tile appears only while the window is up, so you can Cmd-Tab to it, and goes away when the window closes.

Closing the window does not quit rexenv, and that is deliberate. rex on the command line and the AI-agent endpoint are remote controls for the running app; their sockets are opened by the app’s process and die with it. Through 0.4.0, closing the window quit the app, which took both down — and every public tunnel with them — while your sites kept serving. Quit with Quit rexenv in the menu.

If you turn on Start rexenv at login in Settings → Services, rexenv starts straight into the menu bar with no window and runs Start all, so your sites are back after a reboot without a click — it never downloads anything and never prompts at login. Opening rexenv yourself starts nothing; since 29 September 2026 this is the one toggle, and the separate Start services when rexenv opens switch is gone. The exception is a machine where first-run setup is not finished: there it shows the window, because there is nothing useful it could do quietly on a machine that cannot resolve .rex yet.

Keep exactly one copy of rexenv.app

macOS finds an app by its bundle id, not by where it sits, so a second copy — an old one in Downloads, a build left in a project folder — means open -a rexenv, Spotlight and the login item can all start the copy you did not mean. Both copies share the same data folder and the same services, so the symptom is not two apps: it is one app that is the wrong version. Drag the old copy to the Trash after updating.

Updating

rexenv updates itself from Settings → About. With Homebrew, brew update && brew upgrade --cask rexenv also works; with the disk image, quit rexenv — Quit rexenv in the menu-bar menu, since closing the window only hides it — and drag the new copy over the old one. The .rex resolver, a background job that outlives the app, waits until the new copy is whole before it starts from it, so the swap raises no “rexenv quit unexpectedly” report. Updating has the whole picture, including what each refusal means.

Either way your sites, settings and downloaded components are kept — they live in ~/rexenv/Sites and ~/Library/Application Support/dev.rexenv.rexenv/, not inside the app.

Windows

One command (recommended)

In PowerShell — Windows PowerShell 5.1, the one Windows ships, or PowerShell 7:

irm https://rexenv.rex.bd/install.ps1 | iex

It downloads the latest release’s installer, checks it against the release’s own .sha256, runs it silently for your user — no administrator prompt, a Start-menu and a desktop shortcut — and starts rexenv. If rexenv is already installed it changes nothing and says where it is: rexenv updates itself. The script is short; read install.ps1 before you run it.

No SmartScreen dialog, and nothing is bypassed to get there. SmartScreen checks a file carrying the Mark of the Web, which a browser writes on a download. PowerShell’s Invoke-WebRequest writes none — measured on Windows 10 22H2 and Windows 11 24H2. The script does not remove marks and does not touch Microsoft Defender. Two things it does not change: where Smart App Control is on, it blocks unsigned apps whatever their source; and rexenv is still unsigned, so running the command is your decision to trust this source. Under Smart App Control or another App Control policy PowerShell runs in ConstrainedLanguage mode, and the script stops there with a sentence saying so, before it downloads anything.

On Windows on Arm the script says the build is unsupported there and installs the x64 build, which runs under emulation — see Requirements.

The installer

The .exe published beside the macOS disk image, from the same release — the one command above runs this same installer. Everything below was measured on a clean Windows 11 Pro 24H2 machine.

1. Download {release.setupExe} from the releases page.

   Edge stops it on the download shelf first: “rexenv_0.8.13_x64-setup.exe isn’t commonly downloaded. Make sure you trust rexenv_0.8.13_x64-setup.exe before you open it.” — Keep is behind that row’s See more menu.

2. Download the .exe.sha256 beside it, and verify in PowerShell. It answers True, or it answers False:

   (Get-FileHash .\rexenv_*_x64-setup.exe -Algorithm SHA256).Hash -eq (Get-Content .\rexenv_*_x64-setup.exe.sha256).Split()[0]

3. Run it, past SmartScreen — More info, then Run anyway (below).

4. The wizard asks nothing surprising: Welcome → install location (C:\Users\<you>\AppData\Local\rexenv, about 37 MB) → Install → Finish, with Run rexenv and Create desktop shortcut ticked.

   No administrator approval is asked for, because it is a per-user install.

5. Let the Finish page start rexenv, or start it from the Start menu. Both work.

What Windows says about an unsigned installer

rexenv carries no code-signing certificate. It is open source and earns nothing, so it buys none — the same answer the macOS build gives for the same reason. What that costs a browser download is one screen (the one command above meets none of it), and this is that screen word for word, on a Windows 11 with its defaults:

Windows protected your PC Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk. More info · [ Don’t run ]

“Run anyway” is not on that screen. Click More info, and the same dialog adds App: rexenv_0.8.13_x64-setup.exe · Publisher: Unknown publisher and [ Run anyway ] [ Don’t run ]. Run anyway starts the installer directly.

On a machine where SmartScreen is switched off by policy you get a different, shorter dialog instead — “Open File - Security Warning”, “The publisher could not be verified”, Publisher: Unknown Publisher, with Run on the first screen and no “More info” to find. The two are alternatives, not a sequence.

Every release goes through it again

SmartScreen’s judgement is per file hash, and a new build is a new hash. Reputation accrues; a certificate would skip it, and rexenv does not buy one. Verifying the checksum in step 2 is the check that actually tells you the file is the one rexenv published.

Installing over an installed copy asks one more thing

“rexenv is still running: the app, or the small background resolver that keeps your .rex sites answering after you quit. Click OK to stop it and continue.” It asks even with the window closed and rexenv quit, because the .rex DNS answerer is the same rexenv.exe. OK is right: it comes back on the new build by itself a few seconds later, started by its logon task, and .rex keeps resolving throughout. Installers up to 0.8.5 said “rexenv is running! Click OK to kill it” here — same prompt, same answer.

What happens on first launch

rexenv asks twice, where macOS asks three times: one UAC prompt for the .rex DNS rule, and Windows’ own certificate dialog to trust rexenv’s local CA. First run explains exactly what each one writes, and why there is no third.

Where rexenv lives once it is open

rexenv is a tray app. Left-click the tray icon to open the window; right-click for the menu — the reverse of macOS, because that is what Windows users expect. The icon is the colour one, so it stays legible on a dark taskbar.

Closing the window does not quit rexenv. The rex CLI and the AI-agent endpoint are remote controls for the running app, so closing a window would take them down while your sites kept serving. Quit from the tray menu.

The .rex DNS answerer runs as a scheduled task at logon, \rexenv\dns-agent, so your sites keep resolving after you quit rexenv — the same promise macOS makes, different machinery. If that task goes missing, the app’s health check registers it again from rexenv’s own copy of the definition it wrote, rather than only reporting that it could not restart it.

Start rexenv at login in Settings → Services registers a startup app — Task Manager’s Startup tab can turn it off too. At sign-in rexenv opens in the notification area with no window and runs Start all, so your sites are back after a reboot without a click; it never downloads anything and never prompts at login. Opening rexenv yourself starts nothing.

Where the rex CLI goes

A copy at %LOCALAPPDATA%\rexenv\bin, added to your user Path — not a symlink, because creating one on Windows needs a privilege an ordinary account may not have, and a copy in rexenv’s own folder is removable by the uninstall step without touching anything else.

Open a new terminal after installing, or Path will still be the one your shell started with.

What is not in the Windows build

Five components are refused with a message that says why, rather than offered and then failing:

Component	Why not
Apache httpd	On Windows that means Apache Lounge — a third-party trust decision nobody has made
FrankenPHP	Pending its own proof on Windows
Xdebug	Its DLLs must match each PHP’s NTS build and compiler exactly, and none is pinned yet
Redis	No official Windows build exists
MariaDB	No Windows pin — MySQL 8.4 and 8.0 both ship, so there is a database either way

Everything else is the same version as macOS, from a different publisher, and checksum-locked the same way. Pinned versions marks each row.

Updating

rexenv updates itself from Settings → About, the same as macOS: it downloads the new build, checks its signature and checksum, swaps the install directory while the app is running, and restarts on the new version. Your sites, databases and DNS keep running throughout. Updating has the detail.

Linux

One command (recommended)

curl -fsSL https://rexenv.rex.bd/install.sh | bash

It adds rexenv’s apt repository — the signing key travels inside the script — and installs the rexenv package from it for your architecture, amd64 or arm64. Everything the package declares comes with it: WebKitGTK for the window, the tray library, certutil, pkexec, and the libraries MySQL and PostgreSQL load. sudo asks for your password in the terminal. Then it starts rexenv. The script is short; read install.sh before you run it.

Three cases it handles rather than leaving to you:

• The repository lags a brand-new release — it is published right after one. The script then downloads that release’s .deb, checks it against the release’s own .sha256, and installs the file with apt. The repository stays configured, so the next version arrives through it.
• rexenv is already installed. The package is left alone and the script says where it is — rexenv updates itself, and a reinstall could put an older build over a newer one. If the apt repository is not configured yet it adds that and nothing else, so sudo apt upgrade sees later versions too.
• Ubuntu 20.04 is refused with a sentence saying why — its WebKitGTK is older than the one the app’s window needs. A system with no apt gets the AppImage in ~/Applications instead, which is untested outside Ubuntu.

The app itself is not code-signed on Linux either, and nothing needs clicking past: there is no Gatekeeper or SmartScreen in the way of a package you install yourself. What is signed is the repository — apt checks its signature and every package’s hash against it, so a package from it is the one rexenv published there. For a .deb downloaded by hand the trust is yours: the checksum proves the download arrived intact, and that it is rexenv’s rests on HTTPS to github.com, as it does for a browser download.

apt, by hand

The same repository the one command sets up, in four lines — since 29 September 2026:

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://rexenv.github.io/apt/rexenv.gpg | sudo tee /etc/apt/keyrings/rexenv.gpg > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/rexenv.gpg] https://rexenv.github.io/apt stable main" | sudo tee /etc/apt/sources.list.d/rexenv.list
sudo apt-get update && sudo apt-get install rexenv

The key’s fingerprint is 139C C1A4 A197 1376 FC6B 586B D2F2 070D 6DFA 60C9. It is named in signed-by, so it vouches for this one repository and nothing else on the machine, and a repository signed by any other key is refused — apt says NO_PUBKEY. The repository carries the three newest releases, for amd64 and arm64, and is built from the published releases by the public rexenv/apt repository.

The .deb

1. Download {release.debAmd64} or {release.debArm64} from the releases page, and the .deb.sha256 beside it. dpkg --print-architecture says which one is yours.

2. Verify it. It prints OK, or it tells you the file does not match:

   sha256sum -c rexenv_*_$(dpkg --print-architecture).deb.sha256

3. Install it with apt, not dpkg -i — dpkg does not fetch the dependencies the package declares, and apt does:

   sudo apt install ./rexenv_*_$(dpkg --print-architecture).deb

4. Open rexenv from your applications. It starts into the tray.

The .deb also installs the polkit action that makes every password dialog name rexenv and what it is about to change — “rexenv needs administrator permission to change system settings — the .rex DNS route, the HTTPS edge, or the local certificate authority.”

The AppImage

One file per architecture — {release.appImageAmd64} or {release.appImageArm64}, about 87 MB — for a distribution without apt, or a machine you would rather not install a package on.

1. Download it into a folder you own — ~/Applications is what the one command uses. The in-app update replaces the file where it sits, and refuses a read-only or root-owned folder with the fix named.

2. Verify it against the .AppImage.sha256 beside it: sha256sum -c on that file prints OK.

3. Make it executable and run it:

   chmod +x rexenv_*.AppImage && ./rexenv_*.AppImage

What the AppImage does not bring

An AppImage mounts itself with libfuse2, which Ubuntu 22.04 and later do not install by default — sudo apt install libfuse2 (libfuse2t64 on 24.04 and later), or run it with APPIMAGE_EXTRACT_AND_RUN=1. It declares no dependencies: where certutil (libnss3-tools), xdg-utils or the tray library (libayatana-appindicator3-1) is missing, rexenv’s own message names it when it is needed. And its password dialogs are polkit’s generic “run /bin/sh as the super user”, because the sentence naming rexenv comes from a file only the .deb installs.

What happens on first launch

Your desktop’s password dialog appears twice — once for the .rex DNS route together with the local certificate authority in the system store, and once for the web server on ports 80 and 443 when the stack first starts. Your browsers’ own certificate databases take the CA with no prompt. (0.8.9 asked three times; the route and the certificate share a dialog now.) First run explains exactly what each one writes.

Where rexenv lives once it is open

rexenv is a tray app: the colour crowned-R icon in the top bar is its home — Ubuntu’s GNOME shows it through its AppIndicator support. Any click opens the menu: an appindicator has no click event of its own, so the menu is the whole interaction — the stack’s status, Start all and Stop all, your sites, and Open rexenv for the window.

Closing the window does not quit rexenv. The rex CLI and the AI-agent endpoint are remote controls for the running app, so closing a window would take them down while your sites kept serving. Quit from the tray menu. Launching rexenv again while it runs brings its window back — the running copy answers, rather than a second one starting.

The .rex DNS answerer is a systemd user unit, ~/.config/systemd/user/rexenv-dns.service, started when you sign in and restarted if it exits — so your sites keep resolving after you quit rexenv, the same promise macOS and Windows make with different machinery.

Start rexenv at login in Settings → Services adds ~/.config/autostart/rexenv.desktop; at sign-in rexenv starts straight into the tray with no window and runs Start all, so your sites are back after a reboot without a click — it never downloads anything and never prompts at login. Opening rexenv yourself starts nothing.

Where the rex CLI goes

The .deb installs it as /usr/bin/rex, beside /usr/bin/rexenv — on your PATH from the moment the package is installed.

What is not in the Linux build

Four components are refused with a message naming Linux, rather than offered and then failing: Apache httpd, Xdebug, Redis and MariaDB. On macOS all four are Homebrew bottles; Homebrew’s Linux bottles are x86_64-only and would need relinking that rexenv has not written, so none of the four is offered on either architecture.

Everything else ships, natively for x86_64 and arm64: all seven PHP versions — 7.4 is rexenv’s own static build here too — FrankenPHP, nginx, MySQL 8.4 and 8.0, PostgreSQL’s three majors, Mailpit and cloudflared. Pinned versions marks each row.

Updating

rexenv updates itself from Settings → About, as on macOS and Windows. From the .deb, Update downloads the new package, checks it — it must be rexenv, the version the signed release names, your architecture, carrying rexenv and rex — and installs it with one password prompt. From an AppImage it swaps the file beside itself, with no prompt. With the apt repository configured, sudo apt upgrade updates rexenv too: it is the same package, so the two routes never disagree about what is installed. Updating has the detail, including the “WebKitWebProcess closed unexpectedly” report Ubuntu can show over the new window as the old app exits.

Your sites, databases and settings are kept — they live in ~/rexenv/Sites and ~/.local/share/rexenv, not in the package.

Uninstalling

On every platform, do not just delete the app. rexenv installs system-level things that deleting it cannot remove — a root daemon and resolver files on macOS; an NRPT rule, a scheduled task and a Path entry on Windows; a DNS route, a root systemd unit and two certificate trusts on Linux. Uninstall has the one in-app step that undoes them.