# GoatCMS Distribution

Official distribution of **GoatCMS** — installation guide, package repositories, and editor integrations.

- Distribution root: `https://goatcms.com/dist/`
- Latest version: `0.0.3` (also in `https://goatcms.com/dist/LATEST`)
- Version-specific directory: `https://goatcms.com/dist/0.0.3/`

---

## Table of Contents

1. [Distribution Layout](#distribution-layout)
2. [Quick Install (One-liner)](#quick-install-one-liner)
3. [Uninstall](#uninstall)
4. [Manual Install](#manual-install)
5. [VSCode Extension](#vscode-extension)
6. [Package Repositories](#package-repositories)
7. [Integrity Verification](#integrity-verification)
8. [Directory Reference](#directory-reference)

---

## Distribution Layout

Each released version is published under `https://goatcms.com/dist/<version>/` with the following structure:

```
<version>/
├── README.md                  # release notes
├── archives/
│   ├── goat_<v>_linux_amd64.tar.gz
│   ├── goat_<v>_linux_arm64.tar.gz
│   ├── goat_<v>_darwin_arm64.tar.gz
│   ├── goat_<v>_windows_amd64.zip
│   ├── goat_<v>_windows_arm64.zip
├── bin/
│   ├── goat_linux_amd64
│   ├── goat_linux_arm64
│   ├── goat_darwin_arm64
│   ├── goat_windows_amd64.exe
│   ├── goat_windows_arm64.exe
├── packages/
│   ├── goat_<v>_amd64.deb, goat_<v>_arm64.deb
│   └── goat-<v>-1-x86_64.pkg.tar.zst, goat-<v>-1-aarch64.pkg.tar.zst
├── SHA256SUMS
└── SHA256SUMS.sig
```

The installers live at the distribution root and install the version named in `LATEST` unless you choose another one:

- `https://goatcms.com/dist/install.sh` and `https://goatcms.com/dist/uninstall.sh`
- `https://goatcms.com/dist/install.ps1` and `https://goatcms.com/dist/uninstall.ps1`

---

## Quick Install (One-liner)

The installers are self-contained scripts published alongside the binaries.
**They are not embedded in this document** — download and inspect them directly from the distribution.
Both verify the downloaded archive against the release `SHA256SUMS` before installing it.

### Linux / macOS

```bash
curl -fsSL https://goatcms.com/dist/install.sh | sh
```

With arguments (specific version or custom install directory):

```bash
curl -fsSL https://goatcms.com/dist/install.sh | sh -s -- --version 0.0.3
curl -fsSL https://goatcms.com/dist/install.sh | sh -s -- --dir "$HOME/.local/bin"
```

Recommended safety-conscious variant — inspect before running:

```bash
curl -fsSL https://goatcms.com/dist/install.sh -o install.sh
less install.sh
sh install.sh
```

The script detects the OS (`uname -s`) and architecture (`uname -m`), downloads the matching archive
from `archives/` and installs it to `/usr/local/bin` when that directory is writable, otherwise to
`~/.local/bin`. `GOAT_DIST_URL`, `GOAT_VERSION` and `GOAT_INSTALL_DIR` override the defaults.

### Windows (PowerShell, run as Administrator)

```powershell
irm https://goatcms.com/dist/install.ps1 | iex
```

To pass parameters, download the script first:

```powershell
Invoke-WebRequest -Uri https://goatcms.com/dist/install.ps1 -OutFile install.ps1
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
.\install.ps1 -Version "0.0.3" -InstallDir "C:\Tools\GoatCMS"
```

The default directory is `%ProgramFiles%\GoatCMS`, added to the machine `PATH`. The script detects
the CPU architecture through `$env:PROCESSOR_ARCHITECTURE` (with a fallback to `$env:PROCESSOR_ARCHITEW6432`
for 32-bit PowerShell on 64-bit Windows): `AMD64` → `amd64`, `ARM64` → `arm64`.

---

## Uninstall

```bash
curl -fsSL https://goatcms.com/dist/uninstall.sh | sh
curl -fsSL https://goatcms.com/dist/uninstall.sh | sh -s -- --dir "$HOME/.local/bin"
```

```powershell
irm https://goatcms.com/dist/uninstall.ps1 | iex
```

Packages installed from the APT or pacman repository are removed with `sudo apt remove goat` or `sudo pacman -R goat`.

---

## Manual Install

If you prefer to install manually, download the archive that matches your platform.

### Platform / architecture matrix

| Platform | Architecture  | Archive |
|----------|---------------|---------|
| Linux | x86_64 | `archives/goat_<v>_linux_amd64.tar.gz` |
| Linux | ARM64 | `archives/goat_<v>_linux_arm64.tar.gz` |
| macOS | Apple Silicon | `archives/goat_<v>_darwin_arm64.tar.gz` |
| Windows | x86_64 | `archives/goat_<v>_windows_amd64.zip` |
| Windows | ARM64 | `archives/goat_<v>_windows_arm64.zip` |

### Linux / macOS

```bash
VERSION="0.0.3"
BASE="https://goatcms.com/dist/${VERSION}"

# Linux x86_64
curl -fsSL "${BASE}/archives/goat_${VERSION}_linux_amd64.tar.gz" -o /tmp/goat.tar.gz
sudo tar -xzf /tmp/goat.tar.gz -C /usr/local/bin/ goat
goat version
```

> macOS: if Gatekeeper blocks the binary, remove the quarantine attribute:
> `sudo xattr -d com.apple.quarantine /usr/local/bin/goat`

### Windows

```powershell
$VERSION = "0.0.3"
$BASE    = "https://goatcms.com/dist/$VERSION"

Invoke-WebRequest -Uri "$BASE/archives/goat_${VERSION}_windows_amd64.zip" `
                  -OutFile "$env:TEMP\goat.zip"
Expand-Archive -Path "$env:TEMP\goat.zip" -DestinationPath "$env:USERPROFILE\goat"
[Environment]::SetEnvironmentVariable(
    "Path",
    "$([Environment]::GetEnvironmentVariable('Path','User'));$env:USERPROFILE\goat",
    "User"
)
```

---

## VSCode Extension

Goat script language support (syntax highlighting, basic language features) is distributed as a `.vsix` package:

```
https://goatcms.com/dist/vscode/goat-language-0.0.3.vsix
```

### Install from the command line

```bash
curl -fsSL https://goatcms.com/dist/vscode/goat-language-0.0.3.vsix -o /tmp/goat.vsix
code --install-extension /tmp/goat.vsix
```

Windows (PowerShell):

```powershell
Invoke-WebRequest -Uri "https://goatcms.com/dist/vscode/goat-language-0.0.3.vsix" `
                  -OutFile "$env:TEMP\goat.vsix"
code --install-extension "$env:TEMP\goat.vsix"
```

### Install via the VSCode UI

1. Open the Command Palette (`Ctrl+Shift+P` / `Cmd+Shift+P`).
2. Run **Extensions: Install from VSIX…**
3. Select the downloaded `goat-language-0.0.3.vsix` file.

### Verify

Open any `.goat` file. Syntax highlighting should be active in the status bar and editor.

---

## Package Repositories

GoatCMS also publishes native system packages through its own signed repositories.

### APT (Debian / Ubuntu)

Repository root: `https://goatcms.com/dist/repo/apt/`

```bash
# 1. Install the signing key (already in binary OpenPGP format)
sudo install -d -m 0755 /etc/apt/keyrings
sudo curl -fsSL https://goatcms.com/dist/repo/apt/goatcms-archive-keyring.gpg -o /etc/apt/keyrings/goatcms-archive-keyring.gpg

# 2. Add the repository
echo "deb [signed-by=/etc/apt/keyrings/goatcms-archive-keyring.gpg] https://goatcms.com/dist/repo/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/goatcms.list

# 3. Update and install
sudo apt update
sudo apt install goat
```

### Arch Linux

Repository root: `https://goatcms.com/dist/repo/arch/`
Available architectures: `x86_64/`, `aarch64/` (pacman resolves `$arch` automatically).

Add the following block to `/etc/pacman.conf` (before other repositories):

```ini
[goat]
SigLevel = Required DatabaseOptional
Server = https://goatcms.com/dist/repo/arch/$arch
```

Then import the keyring and install:

```bash
sudo curl -fsSL https://goatcms.com/dist/repo/arch/goatcms-archive-keyring.gpg \
  -o /usr/share/pacman/keyrings/goatcms.gpg
sudo pacman-key --add /usr/share/pacman/keyrings/goatcms.gpg
sudo pacman-key --lsign-key "GoatCMS Release <contact@goatcms.com>"

sudo pacman -Sy
sudo pacman -S goat
```

---

## Integrity Verification

Checksums and signatures are published with each release.

```bash
BASE="https://goatcms.com/dist/0.0.3"

curl -fsSL "${BASE}/SHA256SUMS"     -o SHA256SUMS
curl -fsSL "${BASE}/SHA256SUMS.sig" -o SHA256SUMS.sig
curl -fsSL "https://goatcms.com/dist/goatcms-archive-keyring.gpg" -o goatcms-archive-keyring.gpg

# Verify the signature with the GoatCMS release key
gpg --no-default-keyring --keyring ./goatcms-archive-keyring.gpg --verify SHA256SUMS.sig SHA256SUMS

# Verify the files you downloaded
sha256sum --ignore-missing -c SHA256SUMS
```

---

## Directory Reference

| URL | Description |
|-----|-------------|
| `https://goatcms.com/dist/` | Root distribution index |
| `https://goatcms.com/dist/LATEST` | Latest version number |
| `https://goatcms.com/dist/install.sh` | Unix one-liner installer |
| `https://goatcms.com/dist/install.ps1` | Windows one-liner installer |
| `https://goatcms.com/dist/uninstall.sh` | Unix uninstaller |
| `https://goatcms.com/dist/uninstall.ps1` | Windows uninstaller |
| `https://goatcms.com/dist/0.0.3/` | Version 0.0.3 release files |
| `https://goatcms.com/dist/vscode/` | VSCode extension downloads |
| `https://goatcms.com/dist/repo/apt/` | APT repository (Debian / Ubuntu) |
| `https://goatcms.com/dist/repo/arch/` | Arch Linux repository |

---

## After installation

Run `goat build:info` to inspect the compiled mode, license server and trusted key IDs. Run `goat login` before licensed starter operations. Application builds and Goat CLI releases are separate workflows.

Use `goat help worker:ai:run` for worker options. AI workers plan and execute board tasks; the dedicated project CI/CD worker is a separate program.

On a GoatCMS server supporting public website audits, enable the separate audit
lane with `--audits=1 --audit-image=<scanner-image>`. It requires the dedicated
auditor image and a working Chromium sandbox, but no Git profile or repository.
Measurement-provider keys remain on the server. Existing workers leave audits
disabled. Check the installation guide at `child/app/audits/README.md` in the
goatcms.com source tree before enabling the lane.

Worker checks export screenshots, reports and traces through `GOAT_ARTIFACTS_DIR`.
Both Codex and Claude can inspect saved task results with `goat_list_artifacts`
and `goat_read_artifact`. Optional isolated Chromium sessions are disabled by
default and configured with `--browser-config=<JSON>`. Public websites require
both project and task permission; agents request it with `goat_request_permission`
using capability `browser.public_web` and a reason. Ordinary text answers do not
grant access.

## Project infrastructure orchestration

Infrastructure stages can use a paired project orchestrator. The trusted CI
worker tests the pinned allowed-branch commit, prepares GOATENC1 and its schedule,
and hands a signed snapshot over HTTPS to `worker:orchestrator:run`. The private
administrator `worker:infrastructure:gateway` fixes Docker resources and service
programs; recipe updates cannot widen that profile. Production hosts need Docker;
Goat runs in pinned containers without host Go, cron/systemd or a new SSH key.

Pair with `worker:orchestrator:pair --config=/private/orchestrator.json
--pairing-file=/private/one-use-token` (one command). Keep both files private and
select the orchestrator and image digests in the stage. Schedules activate after
successful deployment, continue offline from scoped cached keys and synchronize
history on reconnection. Unknown mutations block until administrator verification
and `worker:orchestrator:reconcile`; lease expiry alone does not release a target.
See `herd/worker/orchestrator/README.md` in the source tree for the private schemas,
provisioning, fixed service actions and recovery procedure.

## License

See the project homepage for license information: <https://goatcms.com>