# Installation

RSigma ships as a single self-contained binary on every supported platform. Pick the install method that matches your environment.

## Requirements

- An x86_64 or arm64 host running Linux, macOS, or Windows.
- Disk space: the binary is roughly 25 MB depending on enabled features.
- No runtime dependencies: RSigma is statically linked except for the system libc.
- For the daemon, an inbound port for the management/metrics API (default `0.0.0.0:9090`).
- For building from source: Rust `{{ rsigma.msrv }}` or newer (`{{ rsigma.edition }}` edition).

## With Cargo

The recommended path for Rust users. Installs the latest released `{{ rsigma.version }}` build with default features (`daemon` enabled, NATS and OTLP off):

```bash
cargo install --locked rsigma
```

Add optional features as needed:

```bash
# Streaming over NATS JetStream
cargo install --locked rsigma --features daemon-nats

# OTLP HTTP + gRPC ingestion
cargo install --locked rsigma --features daemon-otlp

# Windows Event Log (.evtx) input
cargo install --locked rsigma --features evtx

# Cross-rule Aho-Corasick prefilter for large rule sets
cargo install --locked rsigma --features daachorse-index

# Everything at once
cargo install --locked rsigma --features daemon-nats,daemon-otlp,logfmt,cef,evtx,daachorse-index
```

The `--locked` flag pins the dependency graph to the published `Cargo.lock`, which is what CI builds and signs. The [LSP server](../editors/vscode.md) ships in its own crate:

```bash
cargo install --locked rsigma-lsp
```

## Docker

Multi-arch images (linux/amd64, linux/arm64) are published to GitHub Container Registry on every release. Tags include the version (`{{ rsigma.version }}`), `latest`, and per-commit SHAs.

```bash
docker pull {{ rsigma.docker_image }}:latest
docker run --rm {{ rsigma.docker_image }}:latest --help
```

Run with full runtime hardening for production:

```bash
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  -v /path/to/rules:/rules:ro \
  {{ rsigma.docker_image }}:latest rule validate /rules/
```

The image is signed with [Sigstore](https://www.sigstore.dev/) keyless cosign and ships with an SBOM and SLSA Build L3 provenance attestation. Verify before deploying:

```bash
cosign verify \
  --certificate-identity-regexp 'github.com/timescale/rsigma' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  {{ rsigma.docker_image }}:latest
```

See the [Docker deployment guide](../deployment/docker.md) for compose files, hardened systemd units, and Kubernetes-style runtime flags.

## Prebuilt binaries

Cross-platform release archives are attached to every [GitHub release](https://{{ rsigma.repo_url | replace("https://", "") }}/releases). Targets:

| Platform | Archive |
|----------|---------|
| Linux x86_64 (glibc) | `rsigma-x86_64-unknown-linux-gnu.tar.gz` |
| Linux arm64 (glibc) | `rsigma-aarch64-unknown-linux-gnu.tar.gz` |
| macOS x86_64 | `rsigma-x86_64-apple-darwin.tar.gz` |
| macOS arm64 | `rsigma-aarch64-apple-darwin.tar.gz` |
| Windows x86_64 | `rsigma-x86_64-pc-windows-msvc.zip` |
| Windows arm64 | `rsigma-aarch64-pc-windows-msvc.zip` |

Every archive ships with a SLSA build provenance attestation generated by `actions/attest-build-provenance`. Verify with the [GitHub CLI](https://cli.github.com/):

```bash
gh attestation verify rsigma-x86_64-unknown-linux-gnu.tar.gz --repo timescale/rsigma
```

Cosign keyless signatures live on the GHCR Docker image (see [Docker deployment](../deployment/docker.md)); archives use SLSA attestations instead.

```bash
# Linux/macOS, swap the URL for your target
curl -fsSL -o rsigma.tar.gz \
  https://github.com/timescale/rsigma/releases/download/v{{ rsigma.version }}/rsigma-x86_64-unknown-linux-gnu.tar.gz
tar -xzf rsigma.tar.gz
sudo install -m 0755 rsigma /usr/local/bin/rsigma
rsigma --version
```

## Build from source

For development, custom feature flags, or platforms not covered by prebuilt archives.

```bash
git clone {{ rsigma.repo_url }}.git
cd rsigma
cargo build --release --all-features --workspace
./target/release/rsigma --help
```

A workspace build produces every binary: the CLI (`target/release/rsigma`) and the LSP server (`target/release/rsigma-lsp`). See the [contributing guide](../contributing.md) for the full developer workflow.

## Verify the install

```bash
rsigma --version
rsigma --help
```

You should see `rsigma {{ rsigma.version }}` and a list of the top-level command groups (`engine`, `rule`, `backend`, `pipeline`).

## Next steps

- Run your first rule in [the quick start](quick-start.md).
- Learn the [core concepts](concepts.md) of Sigma rules, modes, and pipelines.
- Browse the [full CLI reference](../cli/index.md) once you are ready to dig in.

## Platform notes

- **Linux**: archives are glibc-linked and target Ubuntu 22.04's glibc baseline. They run on any distribution with a comparable or newer glibc. For Alpine or other musl-only environments, prefer the GHCR Docker image, build from source with `cargo build --target x86_64-unknown-linux-musl`, or open an issue if you need official musl binaries.
- **macOS**: the `aarch64-apple-darwin` archive targets Apple Silicon (M1+). On older Intel Macs use the `x86_64` archive.
- **Windows**: the daemon's NATS and OTLP features rely on `tokio` and `tonic` and are fully supported on Windows. File watching for hot-reload uses the native ReadDirectoryChangesW API.
- **Alpine/scratch containers**: prefer the GHCR image, which is built on a minimal glibc base and is fully self-contained.
