INSTALL

Rama main · réplica de lectura del repositorio original.

Installing Quilzo
*****************

From source, or from a release: a signed binary or a container image.  No
release is published yet, so build it from source.


From source
===========

Requirements
------------

Go 1.27 or later.  Nothing else.

This is a Go program with no dependencies: `go.mod` has no require block, so
the standard library and the Go toolchain are the whole build.  There is no
`./configure`, because there is nothing to configure at build time — no
optional libraries to detect and no feature switches.  That is a departure
from the GNU convention and it is a departure with a reason rather than an
omission.


Building and installing
-----------------------

     make
     sudo make install

`make install` honours the usual variables:

     sudo make install prefix=/usr/local     # the default
     make install prefix="$HOME/.local"      # no root needed
     sudo make install DESTDIR=/tmp/stage    # for a package build

To remove it:

     sudo make uninstall


Without make
------------

     go build -o quilzo ./cmd/quilzo
     install -m 0755 quilzo /usr/local/bin/


A container from source
-----------------------

     docker build -t quilzo .
     docker run --rm -v quilzo:/srv quilzo --root /srv/store init
     docker run --rm -v quilzo:/srv quilzo --root /srv/store demo
     docker run -p 8081:8081 -v quilzo:/srv \
       quilzo --root /srv/store site --addr 0.0.0.0:8081

Then http://127.0.0.1:8081.  `demo` publishes, so there is nothing else to run.

One volume, mounted at `/srv` rather than at the store.  `quilzo demo` writes
templates beside the working directory rather than into the store, so keeping
only `/srv/store` loses them and `site` exits with `no template directory at
templates`.  Both live under `/srv`, so that is what is kept.

The base is `gcr.io/distroless/static-debian12:nonroot`: the binary, CA
certificates, a passwd entry and timezone data.  No shell, no package manager,
no interpreter, no libc.  It runs as nonroot, and carries LICENSE and NOTICE in
/usr/share/doc/quilzo.


From a release
==============

Each release publishes one static binary for each of linux, macOS and Windows
on amd64 and arm64, and beside them:

     quilzo.cdx.json      CycloneDX 1.6 bill of materials
     quilzo.crypto.json   cryptographic inventory, with post-quantum status
     SHA256SUMS           for everything above
     LICENSE, NOTICE      the licence, and the notices of what the binary carries

and a container image, ghcr.io/quilzo/quilzo, tagged with the version without
its `v`: the git tag v1.2.3 publishes 1.2.3, 1.2 and latest.

Check a binary before you run it:

     sha256sum -c --ignore-missing SHA256SUMS
     gh attestation verify quilzo-linux-amd64 --repo Quilzo/Quilzo

The checksum proves the file matches the list.  The attestation proves the file
was built by this repository's release workflow, from a tag, and names which
one.  The image has the same:

     gh attestation verify oci://ghcr.io/quilzo/quilzo:latest --repo Quilzo/Quilzo

The bill of materials is generated by the binary rather than read from the
source tree, so it describes the file you downloaded.  It lists the Go standard
library and nothing else, because there is no dependency.


Checking the build
==================

     make check

That runs the whole test suite: one hundred and seventy-three packages, including several that
walk this program's own source and fail when a capability exists in one
interface and not the others.

A test counts the packages and fails naming the right number when this one is
wrong.


A first site
============

     quilzo init
     quilzo template use sections
     quilzo add index=templates/sections.json -m "first page"
     quilzo publish
     quilzo site --addr 127.0.0.1:8081


Licence
=======

Apache License 2.0.  See LICENSE and NOTICE.