Quick start

Download

The install script downloads the latest release for Linux or macOS (amd64, arm64), checks its SHA-256 sums and puts relic in ~/.local/bin and this machine's relic-indexer build in ~/.local/share/relic/indexer:

curl -fsSL https://relic.build/install.sh | sh

RELIC_VERSION pins a release (v0.2.0-beta.4, or 0.2.0-beta.4) and RELIC_INSTALL_DIR changes the directory; the build then goes to share/relic/indexer beside it. The script stops before downloading when the release does not exist or it cannot write to the directory:

curl -fsSL https://relic.build/install.sh | sudo env RELIC_VERSION=v0.2.0-beta.4 RELIC_INSTALL_DIR=/usr/local/bin sh

A Relic server also serves the script at /install.sh. The command on the server's landing page sets RELIC_VERSION to the server's release. The script downloads the binary from GitHub in both cases, so the machine needs access to github.com.

Each release on GitHub (github.com/relicbuild/relic/releases) has archives for Linux, macOS and Windows, relic-indexer builds, an SBOM per archive and build, and relic_<tag>_checksums.txt with its cosign signature. To install by hand, pick the release:

v=v0.2.0-beta.4

Download the archive and the checksum files:

gh release download "$v" --repo relicbuild/relic -p "relic_${v}_linux_amd64.tar.gz" -p "relic_${v}_checksums.txt*"

Check the signature of the sums with cosign 2.5.0 or later (optional):

cosign verify-blob "relic_${v}_checksums.txt" --bundle "relic_${v}_checksums.txt.sigstore.json" --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github.com/relicbuild/relic/'

Check the archive against the sums:

sha256sum -c --ignore-missing "relic_${v}_checksums.txt"

Unpack the archive:

tar -xzf "relic_${v}_linux_amd64.tar.gz"

Install relic in ~/.local/bin:

install "relic_${v}_linux_amd64/relic" ~/.local/bin/

Check the installed version:

relic --version

Run as a service

relic server setup installs Relic as a service (systemd on Linux, launchd on macOS) with SQLite and a local directory. It lists what it will change and asks first; running it again changes nothing. The server serves HTTPS on 127.0.0.1:8090 with a certificate authority it generates (TLS). --listen 0.0.0.0:8090 opens it to the network; clients on other machines then need the authority's ca.crt, and the name they use must be in RELIC_TLS_HOSTNAMES. See Machine setup for every option.

User service

Runs as your user, with no root access needed. Set it up:

relic server setup

On Linux, the service keeps running after logout and starts at boot. On macOS, it is a launch agent that runs while you are logged in. Setup also adds shell completion.

Read the generated admin password:

grep RELIC_ADMIN_PASSWORD ~/.config/relic/server.env

On this machine, relic commands need no sign-in when you run them: the CLI reads the address, admin password and certificate authority from the settings file (details). This stops working once the admin password is changed. Sign in to save a context, which relic package setup needs to hand out a token. The CLI shows the fingerprint of the server's certificate authority and asks whether to trust it; compare it with the one in the server's log, or pass --ca-file ~/.config/relic/tls/ca.crt:

relic auth login https://127.0.0.1:8090 --user admin

Check the service:

systemctl --user status relic

Follow the server's logs:

journalctl --user -u relic -f

On macOS, check the launch agent:

launchctl print gui/$(id -u)/build.relic.server

Follow its log:

tail -f ~/Library/Logs/relic.log

System service

Linux only. Runs as a relic system user and starts at boot. Set it up as root:

sudo relic server setup --system

Setup also adds bash completion for every user.

Read the generated admin password:

sudo grep RELIC_ADMIN_PASSWORD /etc/relic/relic.env

On this machine, relic commands need no sign-in when root and members of the relic group run them: the CLI reads the address, admin password and certificate authority from the settings file (details). This stops working once the admin password is changed. Sign in to save a context, which relic package setup needs to hand out a token. The CLI shows the fingerprint of the server's certificate authority and asks whether to trust it; compare it with the one in the server's log, or pass --ca-file /etc/relic/tls/ca.crt:

relic auth login https://127.0.0.1:8090 --user admin

Check the service:

systemctl status relic

Follow the server's logs:

sudo journalctl -u relic -f

Run by hand

On Windows, or to run the server in the foreground, set the database, the content directory, the admin password and the encryption key yourself.

Create the data directory:

mkdir -p ~/relic-data

Generate the encryption key once and back it up:

openssl rand -base64 32

Set the settings:

export RELIC_DATABASE_URL="sqlite://$HOME/relic-data/relic.db"
export RELIC_OBJECT_STORAGE_TYPE=filesystem
export RELIC_OBJECT_STORAGE_PATH="$HOME/relic-data/objects"
export RELIC_ADMIN_PASSWORD='<password>'
export RELIC_ENCRYPTION_KEY='<key>'

In PowerShell, use $env:NAME = 'value'; the database URL is sqlite:// and the absolute path, such as sqlite://C:/relic-data/relic.db.

Start the server and the worker in one process:

relic server start --worker

The server serves HTTPS on port 8090, keeps its certificate authority in ~/.config/relic/tls and logs the path of ca.crt (TLS).

SQLite or the filesystem store each limit the installation to one node; either combines with PostgreSQL or S3 (Configuration).

Scanners

Relic Scan runs syft and grype, and optionally gitleaks and trivy, from the PATH. Install them yourself, or use the Docker image. Without syft and grype, scanning is off, and client scans such as jf scan and jf audit fail at once with 424 Failed Dependency.

Local scans with the JFrog® CLI

jf scan and jf docker scan download relic-indexer from the server and run it on the client. The server looks for its builds in share/relic/indexer beside the binary's directory. The install script puts this machine's build there, so clients on the same platform work without further setup; others get 404 Not Found.

Install the builds of the platforms your clients use, here Linux on amd64 and macOS on arm64 (each is about 80 MB):

curl -fsSL https://relic.build/install.sh | env RELIC_INDEXER_PLATFORMS="linux/amd64 darwin/arm64" sh

Install only the relic CLI, on a machine that runs no server:

curl -fsSL https://relic.build/install.sh | env RELIC_INDEXER_PLATFORMS= sh

RELIC_INDEXER_DIR puts the builds in another directory; the server needs the same setting:

RELIC_INDEXER_DIR=/var/lib/relic/indexer

Next: Limits and backups.