Build From Source

A source build gives you a chio binary from any revision, so you can test a kernel change against a real CLI before it ships. The checkout pins its Rust toolchain, and Cargo resolves every dependency from Cargo.lock.

1. Install the toolchain

Install Rust with rustup. The checkout's rust-toolchain.toml selects Rust 1.94.1 with clippy and rustfmt, and rustup installs it on the first build. Several dependencies compile native code, so the build also needs a C and C++ compiler, CMake, Protocol Buffers, and OpenSSL headers.

xcode-select --install
brew install pkg-config openssl@3 cmake protobuf jq

sudo apt install build-essential pkg-config libssl-dev \
  cmake protobuf-compiler git jq

2. Clone a revision

Check out the revision you want to build. The revision below is the one these docs were written against; use main to work on the next change.

git clone https://github.com/backbay-labs/chio.git
cd chio
git checkout d7dead908c0e573f0eec03ea416aefbd38146b55

3. Build and install the CLI

cargo install --locked --path crates/products/chio-cli --bin chio --force
chio --version

chio-cli 0.1.0

Cargo installs the binary in $HOME/.cargo/bin. Put that directory ahead of any installed chio on your PATH, or run the source build by its full path. The first build compiles the whole dependency graph, so allow several minutes; later builds recompile only what changed.

4. Build the workspace

Build every crate before you run the tests. A cold workspace build takes longer than the CLI alone.

cargo build --workspace

Other binaries build the same way by package name. The language server that the editor extensions spawn is chio-lsp:

$ cargo build --release -p chio-lsp

    Finished `release` profile [optimized] target(s) in 0.55s

Cargo prints its Finished line on stderr and writes the binary to target/release/chio-lsp.

5. Build the images and release artifacts

Every release publishes the container images, the Proof Room and chio-wall binaries, the Lambda extension layer, and the reference-runtime archive, each signed and checkable with chio release verify. Build them yourself to test a change before it ships. Every builder stage in the four Dockerfiles starts from rust:${RUST_VERSION} pinned to one @sha256: digest.

docker build -f deploy/docker/Dockerfile -t chio:cli .
docker build -f deploy/docker/Dockerfile --target chio-proof-room-quickstart -t chio-proof-room:local .
docker build -f deploy/docker/Dockerfile.sidecar -t chio-sidecar:local .
docker build -f deploy/docker/Dockerfile.tee -t chio-tee:local .

The standalone binaries, the Lambda layer, and the static reference-runtime executables:

cargo build --release --locked -p chio-proof-room -p chio-wall
bash scripts/package-layer.sh arm64
rustup target add x86_64-unknown-linux-musl
cargo build --locked --release --target x86_64-unknown-linux-musl \
  -p chio-cage --bin chio-cage-init --features real-linux-enforcement
cargo build --locked --release --target x86_64-unknown-linux-musl \
  -p chio-secret-broker --bin chio-broker-mcp
cargo build --locked --release --target x86_64-unknown-linux-musl \
  -p chio-reference-tools --bins

6. Work on an SDK

Each SDK lives under sdks/<language> with its own package manifest and tests. Point an application at your working copy with that language's local install, then run the SDK's own test command. The wire types the SDKs share are generated from spec/schemas; regenerate them with make codegen and confirm with make codegen-check before you commit.

Next: run the gates