Skip to main content
This route needs access to the private source repository. Warden’s source is not public, so the Go module proxy cannot serve it and go install fails for anyone without a GitHub account that can read the repository. If you are installing Warden to use it, Homebrew or the container image are the routes that work — both serve public artefacts built from that private source.With access, tell Go to bypass the public proxy and authenticate to GitHub:
Both land in $(go env GOPATH)/bin. Put that on your PATH.

​
You need a C toolchain

CGO_ENABLED=1 is required, and so is a C compiler. Warden links PostgreSQL’s own parser (pg_query_go) rather than approximating SQL with regular expressions, and that parser is C. With cgo disabled the build fails.
This is also why there is no GOOS=windows build and why cross-compiling is awkward: every target needs a toolchain for that target. Releases are built on native runners for exactly this reason.

​
Pinning a version

@latest resolves to the newest tagged release that the proxy — or, for a private module, your own git access — can see. With no tags yet, use @main to track the branch:

​
Checking it worked

A binary built this way reports the version stamped by the module proxy rather than a release’s own version string; warden version printing dev means it came from a branch build rather than a tag.
go install gives you the two executables and nothing else — no policy examples, no compose stack, no certification fixtures. For those, clone the repository.