Skip to main content
Or in one line:
This installs two executables: Confirm it:
Available from the first tagged release. Pushing a vX.Y.Z tag builds macOS and Linux binaries on native runners, publishes them with checksums, and updates the formula. Until that first tag, brew install reports that the tap does not exist.

​
Where the binaries come from

Warden’s source repository is private. The binaries are not: they are published to a separate public repository that holds release archives and checksums and no source code at all. This split is not cosmetic. Homebrew downloads a release asset anonymously, so an archive attached to a private repository fails with a 403 for everyone who is not a collaborator — including you, on a machine that is not signed in. Keeping the artefacts public and the source private is what makes brew install work for anyone while the code stays closed.

​
Upgrading and removing

Uninstalling removes the binaries. It does not touch your configuration, your policies, or the state directory holding the audit chain — those are yours, and deleting them silently would destroy an audit trail.

​
What the formula does not do

  • No service definition. Warden needs a configuration file naming a database, so there is nothing sensible to start automatically. Run warden serve --config … yourself, or use a service manager. The formula prints this as a caveat.
  • No configuration is written. Start from the examples under deploy/ in the repository and read the configuration reference.

​
Maintaining the tap

For whoever owns the tap repository:
  • Create the two public repositories once: ./scripts/bootstrap-distribution.sh from a clone of the private repository. It creates warden-dist and homebrew-tap, both public, both without source, and prints the remaining steps. It is safe to re-run.
  • One token, one secret. The release workflow writes to repositories other than its own, which its built-in GITHUB_TOKEN cannot do. Add a PUBLISH_TOKEN secret to the private repository: a classic token with repo and write:packages, or a fine-grained token with Contents read-and-write on both public repositories.
  • The formula is generated, at Formula/warden.rb, by scripts/brew-formula.sh <version> <checksums.txt> from a release’s own checksums. Do not hand-edit it; the next release overwrites it.
  • To repair a tap by hand: download checksums.txt from a release in warden-dist, run the script, and commit the result.
  • A missing token does not cost you a release. The formula step says so and stops; the binaries are already published.

Verify what you installed

Checksums, what is in each archive, and how releases are built.