---
title: "Cross-Platform CLI Distribution: macOS, Linux, and Windows"
description: "Distributing a Go binary across three OSes means Homebrew, apt, Chocolatey, Apple notarization, code signing, and direct downloads. Here is our distribution strategy."
canonical: https://nowah.xyz/blog/cross-platform-cli-distribution
lastModified: "2026-08-07T08:10:27.435Z"
---

# Cross-Platform CLI Distribution: macOS, Linux, and Windows

Distributing a Go binary across three OSes means Homebrew, apt, Chocolatey, Apple notarization, code signing, and direct downloads. Here is our distribution strategy.

Go compiles to six target platforms in one build step. That is the easy part. Getting those binaries onto developer machines in a way that feels native on each platform is the hard part.

The first macOS user who downloaded our binary and got an "unidentified developer" warning from Gatekeeper taught us that compilation and distribution are very different problems. A binary that works perfectly is useless if the operating system blocks it before the developer can run it.

## Go cross-compilation

![Illustration for this section](https://pics.nowah.xyz/website-media/developer-experience-022-img-1-build-matrix.webp)

Go's cross-compilation is genuinely simple. Set two environment variables and build:

```
GOOS=darwin GOARCH=arm64 go build -o nowah-darwin-arm64
GOOS=darwin GOARCH=amd64 go build -o nowah-darwin-amd64
GOOS=linux GOARCH=amd64 go build -o nowah-linux-amd64
GOOS=linux GOARCH=arm64 go build -o nowah-linux-arm64
GOOS=windows GOARCH=amd64 go build -o nowah-windows-amd64.exe
```

Five commands, six binaries (macOS needs both ARM and Intel for the Apple Silicon transition). Each binary is self-contained with zero runtime dependencies. The build takes under a minute on CI.

We run all six builds on every release in a CI pipeline. Each binary gets a SHA-256 checksum published alongside it. Developers who download directly can verify integrity before running.

## Homebrew for macOS

Most macOS developers install tools with Homebrew. We maintain a Homebrew tap that auto-updates on every release.

```
brew tap nowah/tap
brew install nowah
```

The tap repository is a GitHub repo with a formula file that specifies the download URLs, checksums, and installation steps\. When we publish a new release, a CI action automatically updates the formula with the new version, URLs, and checksums\. Developers who run \`brew upgrade\` get the new version without manual intervention\.

We build Homebrew bottles (pre-compiled binaries for specific macOS versions) to eliminate compilation time during installation. The bottle-building CI runs on both ARM and Intel macOS runners to produce native bottles for each architecture.

The Homebrew channel is by far our most popular installation method on macOS. It handles updates, versioning, and uninstallation natively. Developers get the workflow they expect.

## apt for Linux

![Supporting diagram](https://pics.nowah.xyz/website-media/developer-experience-022-img-2-homebrew-flow.webp)

Debian and Ubuntu users expect \`apt\`\. We host a package repository with GPG\-signed packages:

```
echo "deb [signed-by=/usr/share/keyrings/nowah.gpg] https://apt.nowah.com stable main" | \
 sudo tee /etc/apt/sources.list.d/nowah.list
sudo apt update
sudo apt install nowah
```

The package build pipeline produces \`\.deb\` files from the compiled Go binary, wrapping it with metadata \(version, description, dependencies\) and a systemd\-compatible structure\. Each release triggers an automatic package build and repository update\.

GPG signing is essential\. Without it, \`apt\` warns about unauthenticated packages, and security\-conscious organizations will not install them\. We sign the repository metadata with a dedicated GPG key and publish the public key for verification\.

## Chocolatey for Windows

Windows developers who use package managers typically use Chocolatey:

```
choco install nowah
```

The Chocolatey package wraps the Windows binary with an installation script that places it in a PATH-accessible location. We submit the package to the Chocolatey community repository for discoverability, though developers can also install from our own Chocolatey feed.

Windows distribution has an additional wrinkle: some enterprise environments restrict Chocolatey. For those, we provide an MSI installer and a direct download with a PowerShell install script.

## Apple notarization

macOS Gatekeeper blocks unsigned binaries by default. A developer who downloads our binary directly (not through Homebrew) will see a warning that prevents execution unless they manually override it in System Preferences.

We sign the macOS binary with an Apple Developer ID certificate and submit it for notarization through Apple's \`notarytool\`\. The notarization process scans the binary for malware and issues a ticket\. We then staple the ticket to the binary so Gatekeeper can verify it offline\.

This process adds about three minutes to the release pipeline and costs a $99/year Apple Developer Program membership. It is worth it. The alternative — telling developers to open System Preferences and click "Allow Anyway" — is a terrible first impression.

Homebrew bottles bypass this issue because Homebrew has its own trust mechanism\. But for developers who download directly or use \`curl \| sh\`, notarization is the difference between "it just works" and "my OS says this is dangerous\."

## Direct download

Not everyone uses a package manager. We provide direct downloads with an install script:

```
curl -sSL https://cli.nowah.com/install.sh | sh
```

The install script detects the OS and architecture, downloads the correct binary, verifies the checksum, and places it in \`/usr/local/bin\` \(or \`~/\.local/bin\` if the user does not have root access\)\. It prints what it is doing at each step so the developer can verify the actions\.

We understand the trust concerns with piping \`curl\` to \`sh\`\. The script is hosted on our domain, served over HTTPS, and we publish its source alongside the binaries\. Developers who prefer to inspect before running can download the script, read it, and then execute it manually\.

SHA-256 checksums are published alongside every release on our GitHub releases page and our download page. The checksums file is itself signed with our GPG key for verification.

Distribution is infrastructure that developers only notice when it fails\. Our goal is that \`brew install nowah\` or \`apt install nowah\` or \`choco install nowah\` works on the first try, every time, on every platform\. When it does, the developer's first interaction with our tool is a successful installation — the best possible first impression\.

---

Nowah is an AI travel agent that searches and books real flights and hotels through conversation — no filters, no thirty open tabs. [Plan your next trip](https://app.nowah.xyz).