Build from source

Use a source build if you need to inspect or change STATIC. The published bundles in the Windows, macOS, and Linux guides are simpler for ordinary installation.

For the complete Linux/WSL musl toolchain and packaging sequence, use the local builder recipe. Verify published artifacts with the signature-verification guide.

1. Prepare the toolchain

You need Git, Rust with the target for your machine, Node.js 20, a C/C++ toolchain, cmake, ninja, perl, and pkg-config. On Linux, the build may also require libclang for native TLS dependencies.

git clone https://github.com/un-nf/404.git "$HOME/404-source"
cd "$HOME/404-source"
npm ci --prefix src/STATIC_proxy/build
npm run build --prefix src/STATIC_proxy/build

Use a fresh destination or your existing checkout if $HOME/404-source is already present.

2. Build STATIC

From the repository root:

cargo build --release --locked --manifest-path src/STATIC_proxy/Cargo.toml --bin static_proxy

The binary is under src/STATIC_proxy/target/release/. If Linux reports that it cannot find libclang, install libclang-dev and use the repository’s scripts/resolve-libclang-path.sh helper to set LIBCLANG_PATH.

Verify browser-runtime contracts

The JavaScript builder stages Window, classic-worker and module-worker bundles, then publishes their metadata last. Verification checks outputs against source, schema, builder and dependency lock. Cargo watches those inputs, installs dependencies when its lock stamp changes and embeds a verified matching set. Per-file renames are not a whole-directory atomic transaction. Do not hand-edit generated dist or combine unrelated bundles. For source/contract checks:

npm test --prefix src/STATIC_proxy/build
node src/STATIC_proxy/build/build.js --verify
cargo test --locked --manifest-path src/STATIC_proxy/Cargo.toml

Actual browser/interface behavior, navigation through a rebuilt proxy and privacy-effectiveness fixtures need separate verification. Passing source tests does not mean approximate rendering recognition, cached worker routes or remote relay signaling are resolved. Use the runtime maintenance README and coverage guide. Browser, live-proxy and privacy-effectiveness jobs remain separate from source contracts; failed privacy metrics must not be substituted with functional success. After changing profile JSON, use the existing manifest script described in Profile anatomy.

3. Choose a profile and run

./src/STATIC_proxy/target/release/static_proxy --profiles-path ./src/STATIC_proxy/profiles --list-profiles
./src/STATIC_proxy/target/release/static_proxy --profiles-path ./src/STATIC_proxy/profiles --profile firefox-windows

Run these from the repository root. Use chrome-windows for Chrome or another Chromium-family browser, or edge-windows for Edge. Without a config file, the standalone CLI listener defaults to 127.0.0.1:8443 and the control endpoint to 127.0.0.1:8445. Follow the trust and browser-routing steps in your platform guide using those ports.

Windows distribution builds

The Windows operator path imports a Linux distribution through WSL2. Packaging it from source requires a Linux musl STATIC binary and the built eBPF object, then runs distro/build.sh. Follow the Build and release and the distro source for that separate workflow; a native Windows STATIC binary is not the normal Windows operator path.