# Workflow: install a package

Goal: get `<pkg>` onto a Solnix/illumos machine from the signed cache.

1. **Find it** (don't guess the attr):
   ```
   curl 'https://solnix.io/api/v1/packages?q=<pkg>'
   # or MCP: solnix_search {"query":"<pkg>","kinds":["packages"]}
   ```
2. **Trust the cache** — add to your Nix config:
   ```
   substituters = https://cache.solnix.io
   trusted-public-keys = cache.solnix.io-1:8UNrVAOSOrI9PGHc8/pD2Yqp265ZeYb3OId+gv4+wm8=
   ```
3. **Install:**
   ```
   nix profile install git+https://git.solnix.io/solnix.git#<attr>
   ```
   - `?ref=unstable` for the dev edge; `?rev=<sha>` to pin exactly.
4. **Verify trust tier** if it matters:
   ```
   curl 'https://solnix.io/api/v1/packages/<attr>/attestations'
   ```
   Prefer `verified`/`reproduced`; treat `disputed` with caution.

If the architecture isn't `x86_64-solaris`, check `GET /api/v1/systems` for its
bring-up status first.