# Development and release verification

## Requirements

- Go 1.24 or newer
- Linux
- GNU `sha256sum`, `stat`, and `find`
- `file`

## Local verification

```sh
gofmt -w .
go test ./...
go vet ./...
./scripts/check-docs.sh
./scripts/test-hermetic.sh
./scripts/test-release.sh
./scripts/verify-clean-machine.sh
```

`test-hermetic.sh` runs the complete uncached Go suite as an unprivileged user and verifies that readable host configuration content and metadata remain unchanged.

`verify-clean-machine.sh` uses isolated identity and XDG roots to exercise installation, Profile workflows, hermetic Target workflows, diagnostics, reset confirmation, Shell integration, and removal.

## Release build

```sh
VERSION=v1.0.0 ./scripts/build-release.sh
sha256sum -c dist/SHA256SUMS
file dist/proxyctl-linux-amd64 dist/proxyctl-linux-arm64
```

The release consists of Linux amd64 and arm64 single binaries plus `SHA256SUMS`; it does not produce distribution packages or archives.

`test-release.sh` builds twice, compares binaries and checksum manifests, validates both architectures and checksums, and verifies that process-test seams cannot enter a release artifact.