`erebus build`

Package an app directory into a single self-extracting .erebus executable.

erebus build [OPTIONS] [APP]

APP defaults to .. The output is app.erebus unless -o is given (a trailing slash appends app.erebus to the directory).

Runtime selection

The runtime is auto-detected from the app directory (Python, Binary). Override the detected interpreter with --embed-interpreter (for example python3 for Python, or the path to a native binary).

Common options

Flag	Description
`-o, --output <PATH>`	Output file (default `app.erebus`)
`-k, --key <PATH>`	Ed25519 signing key (32 raw bytes)
`--isolation <MODE>`	Isolation level: `none` (0), `sandbox` (1), `hard` (2) (default `sandbox`)
`--seccomp`	Install a seccomp BPF denylist at runtime
`--landlock`	Enable Landlock LSM filesystem sandbox
`--encrypt`	Encrypt the payload (AES-256-GCM, key derived from signing seed)
`--squashfs`	Use SquashFS instead of zstd+tar for the payload
`--no-install`	Skip dependency installation
`--env-file <PATH>`	Bake in a `KEY=VALUE` env file
`--env KEY=VALUE`	Set an env var (repeatable)
`--define KEY=VALUE`	Build-time define, injected as an env var (repeatable)
`--version-info <STR>`	Version string recorded in metadata
`--author <STR>`	Author string recorded in metadata
`--description <STR>`	Description recorded in metadata
`--license <STR>`	License string recorded in metadata
`--include <PATH>`	Extra files/dirs to embed in the rootfs (repeatable)
`--dry-run`	Print the build plan without building
`--json`	Emit a JSON build result on stdout
`-v/--quiet`	Verbose / quiet output

.env and secrets: an app directory containing a .env file is rejected unless you pass --include <app>/.env explicitly. The file is excluded from the payload by default because its secrets would be extractable from the redistributable binary by anyone who holds it. Prefer --env-file / --env to bake configuration into the binary metadata, and reserve --include .env for cases where bundling the file is the app’s intended deployment model.

SISR options (incremental self-updates)

Flag	Description
`--enable-sisr`	Enable delta-indexing: content-chunk the payload, embed a SISR section and write `<output>.manifest`
`--key <PATH>`	With `--enable-sisr`: signs the SISR manifest instead of the binary
`--update-url <URL>`	Base URL of the update channel; embedded in the binary and used by `--erebus-update`

# Updatable binary: SISR section + signed manifest + embedded update channel
erebus build ./my_app -o my_app.erebus \
    --enable-sisr \
    --key ~/.erebus/keys/<fingerprint>.key \
    --update-url https://updates.example.com/my_app

This produces two artifacts:

my_app.erebus — the self-extracting binary (payload is content-addressed; unchanged chunks can be reused in place during an update);
my_app.erebus.manifest — the signed XBMR remote manifest that the launcher fetches and verifies before applying an update.

Publish both, plus the chunk files, to the update channel so target machines can run ./my_app.erebus --erebus-update (see User-updates).

Signing semantics

The Ed25519 key file is the same 32 raw bytes used by erebus sign. When --enable-sisr is given, --key signs the manifest (the SISR footer carries the signature; the launcher verifies it against your trusted keys). Because the binary signature block would be inserted after the metadata and truncate the SISR section, a single erebus build signs either the binary (no --enable-sisr) or the manifest (--enable-sisr), never both. The private key bytes are never printed; under Unix a key file that is not mode 0600 produces a warning.

Behavior

Detects the runtime and installs dependencies (--no-install to skip).
Copies the app into a rootfs, optionally embedding an interpreter.
Creates a deterministic zstd+tar payload (or SquashFS).
Builds metadata (env, entrypoint, hashes, update_url).
Assembles the binary — with --enable-sisr the payload is content-chunked (64 KiB targets) and the signed manifest is emitted.

Dry run

--dry-run prints the full plan — runtime, isolation, compression, SISR, package managers, file count — without building anything:

erebus build ./my_app --enable-sisr --update-url https://… --dry-run

Keyboard shortcuts

erebus