Installing Warden

Go install

go install github.com/warden-app/warden/cmd/warden@latest

This is cross-platform and follows your Go toolchain's configured binary directory.

Linux and macOS

The recommended installer is per-user and does not require sudo:

curl -fsSL https://warden-deck.github.io/install.sh | sh

It installs to ~/.local/bin/warden. If that directory is not in PATH, the installer prints the shell-profile line to add it. The installer downloads checksums.txt from the same release and refuses a missing or mismatched SHA-256 value before extraction.

For a deliberate machine-wide install:

curl -fsSL https://warden-deck.github.io/install.sh | sudo sh -s -- --system

--system installs to /usr/local/bin/warden. The installer rejects accidental sudo use in normal per-user mode. Set WARDEN_INSTALL_DIR for another per-user destination. A controlled mirror can set WARDEN_RELEASE_BASE to a directory containing the matching archive and checksum manifest.

Windows

GitHub Releases provide warden-windows-amd64.zip and warden-windows-arm64.zip. Extract warden.exe somewhere on PATH, or use go install.

Release targets

Every published release includes six archives: Linux, macOS and Windows for both amd64 and arm64. The installer detects the supported operating system and architecture and downloads the matching archive.

Release verification

All six targets are cross-built with CGO disabled and -trimpath, stamped from the release tag and packaged from one clean checkout. The release job verifies tests, vet, frontend smoke checks, embedded Nift output, build-path absence and Git-history hygiene before uploading archives plus checksums.txt.

Upgrade and rollback

Before replacing the executable, stop Warden and take a complete copy of its configuration directory. Start the new version and verify login, authority, audit and one durable object. Warden migrates older schemas transactionally and runs an integrity check, but it will not open a schema newer than itself. Rollback therefore means restoring the matching pre-upgrade data snapshot before starting the older binary.

Frontend assets

The release binary embeds the generated Nift frontend. Source development still uses content/ and templates/ as the frontend source of truth and rebuilds public/ with Nift before compiling Go.