---
component: artifact-cache
version: "1.7"
slug: artifact-cache/download-the-cli
canonical_url: "https://docs.develocity.ai/artifact-cache/1.7/download-the-cli/"
title: "Download the CLI"
description: "Download the Artifact Cache CLI JAR file from a Develocity Edge node, or host a verified copy in your own internal repository for CI jobs to fetch."
keywords:
- "Setup Cache"
- "installation"
- "edge"
- "CI"
status: current
---
# Download the CLI
A custom CI pipeline workflow needs the Artifact Cache CLI JAR file on the CI agent before it can access Artifact Cache or Setup Cache. There are two ways to put it there: fetch it from a Develocity Edge node, or host a copy inside your own network.
> [!NOTE]
> If on GitHub Actions or Jenkins, please refer to the [Configuring GitHub Actions](https://docs.develocity.ai/artifact-cache/1.7/how-to/configure-github-actions/) or [Configuring Jenkins](https://docs.develocity.ai/artifact-cache/1.7/how-to/configure-jenkins/) guides.
For the versions released so far and what changed in each, see [Release History](https://docs.develocity.ai/artifact-cache/1.7/release-history/).
## Downloading From an Edge Node
Develocity Edge nodes serve the `develocity-artifact-cache-cli` JAR file, so a CI job fetches the CLI from the Edge it already uses for the cache. You host nothing, and the version a CI agent receives is the version the job requested.
Requesting a version that an Edge does not yet hold makes Develocity download it from the public release channel, verify its checksum, and pass it to the Edge, which retains it for later requests. An operator can also seed a version, which serves it without any access to the public release channel.
This method requires Edge node 2.3.0 or later, connected to Develocity 2026.3.0 or later.
### Download Command
Request an exact version from your Edge, authenticating with the same Develocity access key your builds use for the cache:
```shell
curl --fail --location \
--connect-timeout 5 --max-time 120 \
--retry 3 --retry-delay 3 --retry-max-time 180 \
--header "Authorization: Bearer ACCESS_KEY" \
--output develocity-artifact-cache-cli.jar \
https://edge.example.internal/edge/assets/artifact-cache-cli/1.7.0
```
The retry and timeout options keep a transient network fault from failing the job. The body timeout is longer than you would set against your own artifact repository, because the first request for a version an Edge does not hold waits for Develocity to fetch and verify it.
The access key’s user needs permission to read Build Cache data, which CI agent users configured for Artifact Cache already have.
Add this step to your CI job before the restore command. The JAR file runs the same way whichever method you use: see [Artifact Cache CLI Commands Reference](https://docs.develocity.ai/artifact-cache/1.7/reference/cli-commands/).
### Verification
Develocity verifies the JAR file’s SHA-256 checksum against the published checksum before an Edge stores it. The Edge does not serve the checksum or the PGP signature files alongside the JAR file, so a CI job cannot repeat that verification locally. To verify a release yourself, download it from the release channel as described in [Hosting the Binary Yourself](#hosting-the-binary-yourself).
For the endpoint reference, the storage and eviction behavior, and the seeding procedure, see [Serving the Artifact Cache CLI](https://docs.develocity.ai/edge/2.3/#serving-the-artifact-cache-cli) in the Develocity Edge User Manual.
## Hosting the Binary Yourself
Download the CLI binary, upload it to your internal artifact repository (such as Artifactory, Nexus, or a file server), and point your CI jobs at that copy. Host the binary yourself when your security process requires reviewing every binary before it runs on a build machine, or when your Edge nodes predate 2.3.0.
Keeping the binary inside your network gives you:
* Control over artifact availability
* Compliance with corporate security policies
* Download speeds within your own network
### Download
You can download the latest version of `develocity-artifact-cache-cli` JAR file and its associated files from the following links:
* [JAR file](https://docs.develocity.ai/downloads/develocity-artifact-cache-cli/develocity-artifact-cache-cli-1.7.0.jar)
* [JAR file SHA256 checksum](https://docs.develocity.ai/downloads/develocity-artifact-cache-cli/develocity-artifact-cache-cli-1.7.0.jar.sha256)
* [JAR file PGP signature](https://docs.develocity.ai/downloads/develocity-artifact-cache-cli/develocity-artifact-cache-cli-1.7.0.jar.asc)
* [JAR file PGP signature SHA256 checksum](https://docs.develocity.ai/downloads/develocity-artifact-cache-cli/develocity-artifact-cache-cli-1.7.0.jar.asc.sha256)
```shell
curl -L -o develocity-artifact-cache-cli.jar https://docs.develocity.ai/downloads/develocity-artifact-cache-cli/develocity-artifact-cache-cli-1.7.0.jar
```
To validate the binary:
1. Download the checksum file:
```shell
curl -L -o develocity-artifact-cache-cli-1.7.0.jar.sha256 https://docs.develocity.ai/downloads/develocity-artifact-cache-cli/develocity-artifact-cache-cli-1.7.0.jar.sha256
```
2. Validate the binary against the checksum file:
```shell
echo "$(cat develocity-artifact-cache-cli-1.7.0.jar.sha256) develocity-artifact-cache-cli.jar" | sha256sum --check
```
3. If valid, the output is:
**Output:**
```
develocity-artifact-cache-cli.jar: OK
```
4. If the check fails, `sha256` exits with nonzero status and prints output similar to:
**Output:**
```
develocity-artifact-cache-cli.jar: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
```
> [!NOTE]
> Download the same version of the binary and checksum.
### Verifying the GPG Signature
The `develocity-artifact-cache-cli` JAR is published alongside its PGP signature. The public key is published to [keys.openpgp.org](https://keys.openpgp.org). You can verify the signature as follows:
```shell
curl -OL https://docs.develocity.ai/downloads/develocity-artifact-cache-cli/develocity-artifact-cache-cli-1.7.0.jar && \
curl -OL https://docs.develocity.ai/downloads/develocity-artifact-cache-cli/develocity-artifact-cache-cli-1.7.0.jar.asc && \
gpg --keyserver keys.openpgp.org --recv-key 15D543CA40743FFA47654C16622DE19DC011B9BE && \
gpg --verify develocity-artifact-cache-cli-1.7.0.jar.asc develocity-artifact-cache-cli-1.7.0.jar
```
The output of the last command should look similar to the following:
**Output:**
```
gpg: Signature made Mon Sep 7 06:05:18 2026 UTC
gpg: using RSA key D9B2DFBD9F3298BA
gpg: Good signature from "Gradle Inc. " [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 15D5 43CA 4074 3FFA 4765 4C16 622D E19D C011 B9BE
Subkey fingerprint: E287 9931 BCA1 A42E 55F2 D64D D9B2 DFBD 9F32 98BA
```
This verifies that the artifact was signed with the private key that corresponds to the imported public key. The warning is emitted because you haven’t explicitly trusted the imported key (therefore `[unknown]`). One way of establishing trust is to verify the fingerprint over a secure channel. Please contact [Develocity support](https://support.gradle.com/) to arrange that.
> [!NOTE]
> This key signs develocity-artifact-cache-cli 1.6.0 and every later release. 1.5.0 and earlier were signed with the previous key, 7B79ADD11F8A779FE90FD3D0893A028475557671, which was revoked on 17 August 2026 with the reason Key is superseded. Those signatures remain valid, and gpg still verifies them, reporting the revocation alongside the result. Fetch the previous key from keyserver.ubuntu.com rather than keys.openpgp.org, which no longer serves that key’s user IDs; gpg refuses to import a key that carries none.
## Related Documentation
* [Release History](https://docs.develocity.ai/artifact-cache/1.7/release-history/)
* [CLI Commands Reference](https://docs.develocity.ai/artifact-cache/1.7/reference/cli-commands/)
* [System Requirements](https://docs.develocity.ai/artifact-cache/1.7/reference/requirements/)