Install GoReleaser Pro
See all releases on GitHub.
Homebrew Tap
brew install --cask goreleaser/tap/goreleaser-proNPM
npm i -g @goreleaser/goreleaser-proScoop
scoop bucket add goreleaser https://github.com/goreleaser/scoop-bucket.git
scoop install goreleaser-proWinget
winget install goreleaser-proApt Repository
echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
sudo apt update
sudo apt install goreleaser-proYum Repository
echo '[goreleaser]
name=GoReleaser
baseurl=https://repo.goreleaser.com/yum/
enabled=1
gpgcheck=0
exclude=goreleaser' | sudo tee /etc/yum.repos.d/goreleaser.repo
sudo yum install goreleaser-proAUR
yay -S goreleaser-pro-binNUR
First, you’ll need to add our NUR to your Nix configuration. Follow the NUR installation guide.
Once you do that, you can install the packages.
{ pkgs, lib, ... }: {
home.packages = with pkgs; [
nur.repos.goreleaser.goreleaser-pro
];
}Docker
Registries:
Example usage:
docker run --rm --privileged \
-v $PWD:/go/src/github.com/user/repo \
-v /var/run/docker.sock:/var/run/docker.sock \
-w /go/src/github.com/user/repo \
-e GITHUB_TOKEN \
-e DOCKER_USERNAME \
-e DOCKER_PASSWORD \
-e DOCKER_REGISTRY \
-e GORELEASER_KEY \
goreleaser/goreleaser-pro releaseWarning
The provided Docker image does not support the Snapcraft feature.
The DOCKER_REGISTRY environment variable can be left empty when you are
releasing to the public Docker registry.
If you need more than that, keep your own image. You can use the GoReleaser Dockerfile as a starting point.
Note
There are also :nightly tags available with the latest nightly builds.
Linux packages
Download the .deb, .rpm, or .apk packages from the releases page and
install them with the appropriate tools.
To install, after downloading the files, run:
dpkg -i goreleaser*.deb
rpm -ivh goreleaser*.rpm
apk add --allow-untrusted goreleaser*.apkBash Script
This script does not install anything. It downloads, verifies, and runs GoReleaser, so you can use it in scripts and CI pipelines.
curl -sfL https://goreleaser.com/static/run | DISTRIBUTION=pro VERSION=v2.18.0 bash -s -- checkNote
The VERSION environment variable can be omitted to get the latest stable
version, or you can set it to nightly to get the last nightly build.
Manually
Download the pre-compiled binaries from the releases page and copy them to the desired location:
Verifying the artifacts
Binaries
Signatures
All artifacts are checksummed, and the checksum file is signed with cosign.
Download the files you want, plus the
checksums.txtandchecksums.txt.sigstore.jsonfiles, from the releases page:wget 'https://github.com/goreleaser/goreleaser-pro/releases/download/v2.18.0/checksums.txt' wget 'https://github.com/goreleaser/goreleaser-pro/releases/download/v2.18.0/checksums.txt.sigstore.json'Verify the signature:
cosign verify-blob \ --certificate-identity 'https://github.com/goreleaser/goreleaser-pro-internal/.github/workflows/release-pro.yml@refs/tags/v2.18.0' \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --bundle checksums.txt.sigstore.json \ ./checksums.txtIf the signature is valid, verify that the SHA256 sums match the downloaded binary:
sha256sum --ignore-missing -c checksums.txt
Attestations
GitHub does not yet allow cross-repository attestations (for example, building a private repository and publishing the attestations in a public one), so this isn’t available.
Docker images
Our Docker images are signed with cosign.
Verify the signatures:
cosign verify \
--certificate-identity 'https://github.com/goreleaser/goreleaser-pro-internal/.github/workflows/release-pro.yml@refs/tags/v2.18.0' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
goreleaser/goreleaser-proSBOMs
Each archive has a Software Bill of Materials in SPDX JSON format,
generated with Syft.
The file name is the archive name plus the .sbom.json suffix.
Download them from the releases page:
For example, to get the SBOM of the Linux x86-64 archive:
wget 'https://github.com/goreleaser/goreleaser-pro/releases/download/v2.18.0/goreleaser-pro_Linux_x86_64.tar.gz.sbom.json'The SBOM files are also in checksums.txt, so you can verify them with the
steps in Verifying the artifacts.
Nightly builds
Nightly builds are pre-releases of the current code in the main branch. Use them for testing out new features only.
Download the pre-compiled binaries from the nightly release and copy them to the desired location.
Docker images are also available, look for tags with a -nightly
suffix for the last nightly of a specific release, or the :nightly tag,
which is always the latest nightly build available.
You may also use the Bash Script method by setting the VERSION
environment variable to nightly.