The everybody chain

Some slogans come to you in the shower. "The everybody chain" came to me mid-sentence while I was describing the install UX to myself and I stopped typing and went "oh that's the one". It's also now literally true, which matters more than the alliteration.

Here's the one-liner as of this afternoon:

macOS / Linux:

curl -fsSL https://testnet.asentum.com/install | sh

Windows PowerShell:

iwr -useb https://testnet.asentum.com/install/install.ps1 | iex

Run either in a terminal. Fifteen seconds later you have a running Dilithium3 wallet on a post-quantum L1 blockchain, funded by the testnet faucet, with a balance displayed in your terminal. No Node install. No npm. No git clone. No "first set up your dev environment". No account on GitHub, on npm, on Apple, on Microsoft, on anything. No prerequisites of any kind beyond "you already have a terminal".

The previous article covered the Node SEA build pipeline — how we turn the CLI into one 100 MB self-contained binary per platform. This one is about everything that happens AFTER you have the binary.

the install script, in four beats

The installer is ~200 lines of bash (install.sh) and ~160 lines of PowerShell (install.ps1). They do the same four things:

1. Detect platform + arch. uname -s / uname -m for bash; [Environment]::Is64BitOperatingSystem + $env:PROCESSOR_ARCHITECTURE for PowerShell. Maps to one of darwin-arm64, darwin-x64, linux-x64, win-x64.

1. Download the right binary from https://testnet.asentum.com/install/asentum-<platform>-<arch> via curl -fsSL or Invoke-WebRequest. Verifies the file is >50 MB before accepting it — if you got a 404 HTML page back by mistake, this catches it before you end up with a broken binary in your PATH.

1. Install to ~/.asentum/bin/asentum (unix) or %LOCALAPPDATA%\Asentum\bin\asentum.exe (windows). Note: user-scoped, no sudo, no admin. Never touches /usr/local/bin or Program Files. The install never prompts for a password. Never.

1. Pre-configure the RPC URL to point at the testnet it was just downloaded from. This one I missed on the first try. The installer did its job, installed the binary, added PATH, and then asentum quickstart failed because the fresh CLI was still pointing at the hardcoded default http://127.0.0.1:8545. Fixed by having the install script run asentum config set rpc https://testnet.asentum.com before it hands off to the user. Non-obvious until you test end-to-end. Which I did. Which is why I caught it.

Then it patches your shell rc (.zshrc / .bashrc) to add ~/.asentum/bin to PATH, or updates the Windows user PATH registry entry. And prints a short "next step: open a new terminal" hint if it had to touch the PATH, so the user knows their current shell won't see the new command until they reopen it.

hosting is one Caddy route

The VPS already runs Caddy reverse-proxying testnet.asentum.com → 127.0.0.1:8545. I added two new handle blocks above the reverse-proxy catchall:

testnet.asentum.com {
    # Bare /install returns install.sh so `curl | sh` works.
    handle /install {
        root * /opt/asentum/install
        rewrite * /install.sh
        header Content-Type "text/x-shellscript; charset=utf-8"
        file_server
    }

    # Everything else under /install/ is a static file (binaries, install.ps1).
    handle_path /install/* {
        root * /opt/asentum/install
        file_server { browse }
    }

    # Node JSON-RPC + explorer (catchall — unchanged).
    handle {
        reverse_proxy 127.0.0.1:8545 {
            header_up X-Forwarded-Proto https
            header_up X-Real-IP {remote_host}
        }
    }

    # ... existing headers + logging + encoding blocks ...
}

Three new static files on disk: the two install scripts and three binaries. Total size on disk is 293 MB. Total new infra is zero. Same box, same cert, same service. Caddy systemctl reload was graceful — the running node never saw a flinch. Chain stayed at its 2.000s rhythm throughout.

the honest caveats

macOS Gatekeeper quarantine. When curl downloads a binary, macOS marks it with an extended attribute called com.apple.quarantine. First time you try to run a quarantined binary, Sequoia shows "cannot be opened because Apple cannot verify it". The install script runs xattr -d com.apple.quarantine immediately after download, which strips the flag before macOS ever asks. Non-dev users never see the dialog.

Windows SmartScreen is harder. Modified PE files lose their Authenticode signature, and Windows 11's SmartScreen treats any unsigned exe downloaded from the internet as suspicious. First run shows "Windows protected your PC" with a "Run anyway" link buried under "More info". The install script prints a clear heads-up about this. One extra click, once per machine, forever. Real fix is an Authenticode EV cert ($200-400/year), which I'll pay for when the project has users who care enough about one click to make the cert worthwhile. For now: the click is there.

That binary is 100 MB and ships the entire Node.js runtime. This is the biggest objection to Node SEA and I want to name it out loud: yes, the Node runtime is the overwhelming majority of the file size. A hand-optimized native wallet written in Go or Rust could easily be 5-10 MB. But we're a JavaScript L1. We chose JS on purpose, in Phase 0, two years ago, because "the contract dev pool is the entire JS ecosystem" is the load-bearing reason the project exists. A 100 MB wallet binary is the cost of that choice. The cost is fine. Modern machines don't care, and the UX win — zero prereqs, zero setup, 15-second install — is worth it.

the end-to-end test

I built the binary, rsync'd it to the VPS, added the Caddy routes, reloaded, and then ran this in a terminal on my own machine:

FAKE_HOME=/tmp/asentum-install-e2e
rm -rf $FAKE_HOME && mkdir -p $FAKE_HOME
env -i HOME=$FAKE_HOME PATH=/usr/bin:/bin TERM=xterm \
  bash -c 'curl -fsSL https://testnet.asentum.com/install | sh'

env -i strips my entire environment — no $NODE_PATH, no $HOMEBREW_PREFIX, nothing from my dotfiles. PATH=/usr/bin:/bin removes everything except the stock Unix tools shipped with macOS. HOME=$FAKE_HOME points at a throwaway directory so the test doesn't touch my real ~/.asentum/. This is as close as I can get to "a fresh Mac from the factory" without actually formatting a Mac.

Inside that stripped environment, the install script ran cleanly, pulled the darwin-arm64 binary (113 MB) from the CDN-less CX22 box in maybe 50 seconds, installed it to $FAKE_HOME/.asentum/bin/asentum, pre-configured the RPC, patched the fake .zshrc.

Then I ran the installed binary directly:

$ /tmp/asentum-install-e2e/.asentum/bin/asentum quickstart

[1/4] Checking connection…
      ✓ connected to https://testnet.asentum.com (height 18267)
[2/4] Setting up your account…
      ✓ created new account 'default'
      address: 0xD84a5623337523b10909b54189Eb40BB19B0F104
[3/4] Requesting 100 ASE from the faucet…
      ✓ faucet drip queued — tx 0xb474daa84a456ff4…
[4/4] Waiting for the next block, then showing balance…
      balance: 100 ASE (100000000000000000000 wei)

✓ you are all set

From curl | sh in an empty shell, through a Dilithium3 keypair generation, a TLS POST to the faucet, a 2-second wait for the next block, a balance query via eth_getBalance, a number displayed in the terminal — all in one uninterrupted sequence. No prompts. No errors. No "please install Node". No "first create a GitHub account". No "accept the terms of service". No "would you like to upgrade your plan".

Just: one line of terminal input, fifteen seconds of waiting, and a funded post-quantum wallet.

why "everybody chain"

Because the Phase 0 design goal — "anyone can run a validator on a Pi" — was always going to need a partner goal: anyone can USE the chain from the laptop they already own. Running a validator is the infrastructure side of decentralization. Running a wallet is the participation side. Both need to be easy. Both need to avoid "first install 11 dependencies". Both need to be accessible to someone whose last interaction with a terminal was in a college CS class.

Phase 6 made the chain reachable by anyone with a browser. Phase 7 makes the CLI wallet installable by anyone with a terminal. Phases 6 and 7 together mean: if you have a laptop, you can use AsentumChain. That's it. That's the bar.

Tomorrow I'm redesigning the block explorer to look like an actual piece of software people would want to click through, instead of a phosphor-green terminal demo. New branding, clickable blocks with full detail views, proposer highlights, real dark mode. Because the other half of "everybody chain" is: when a non-dev clicks the link, what they see has to look like something they recognize as software. Not a 1990s mainframe UI.

But that's tomorrow. Today, fifteen-second installs. Share the link. Watch them click it.

— milkie