Install Guide

This guide covers downloading, verifying, and installing all five SPORK packages. Every package ships as a single self-extracting ELF binary -- no package manager, no runtime dependencies, no extraction tools required.

1. System Requirements

2. Download

All installers are available from the SPORK release server. Download only the package you need.

Download Commands

Replace the filename with the package you need:

# spork-client (Apache-2.0)
curl -fLO https://rayketcham.com/CRLs/sp0rk/static/spork-client-0.3.0-beta.11-linux-x86_64-installer

# spork-ca (BSL-1.1)
curl -fLO https://rayketcham.com/CRLs/sp0rk/static/spork-ca-0.3.0-beta.11-linux-x86_64-installer

# spork-acme-server (BSL-1.1)
curl -fLO https://rayketcham.com/CRLs/sp0rk/static/spork-acme-server-0.3.0-beta.11-linux-x86_64-installer

# spork-scep-server (BSL-1.1)
curl -fLO https://rayketcham.com/CRLs/sp0rk/static/spork-scep-server-0.3.0-beta.11-linux-x86_64-installer

# spork-est-server (BSL-1.1)
curl -fLO https://rayketcham.com/CRLs/sp0rk/static/spork-est-server-0.3.0-beta.11-linux-x86_64-installer

3. Verify

Each installer is Ed25519-signed and contains embedded SHA3-256 checksums. You can verify integrity and authenticity before installing.

Self-Verification (Recommended)

Every installer can verify itself with a single command:

./spork-client-0.3.0-beta.11-linux-x86_64-installer --verify
./spork-ca-0.3.0-beta.11-linux-x86_64-installer --verify
./spork-acme-server-0.3.0-beta.11-linux-x86_64-installer --verify
./spork-scep-server-0.3.0-beta.11-linux-x86_64-installer --verify
./spork-est-server-0.3.0-beta.11-linux-x86_64-installer --verify

This checks the Ed25519 signature and SHA3-256 checksums of all embedded binaries. If verification passes, the installer prints OK and exits with status 0. If verification fails, it prints an error and exits with a non-zero status.

Manual Verification

For independent verification, the release server also provides:

• SHA3SUMS -- SHA3-256 checksums for all installer files
• RELEASE.json -- Machine-readable release metadata (version, checksums, signatures)

# Download and check SHA3SUMS
curl -fLO https://rayketcham.com/CRLs/sp0rk/static/SHA3SUMS
sha3sum -c SHA3SUMS

4. Install

The install process is the same for every package:

chmod +x spork-*-installer
sudo ./spork-*-installer

What the Installer Does

1. Verifies embedded SHA3-256 checksums and Ed25519 signature
2. Extracts statically linked binaries to /usr/local/bin/
3. Creates data directories (e.g., /opt/spork-acme/, /var/lib/spork/) as needed
4. Optionally installs systemd service files for server packages
5. Prints a summary of installed components

5. Per-Package Details

spork-client

License: Apache-2.0 (free for any use)

Installs the spork binary. Use it for:

• TLS probing -- connect to any server and inspect its TLS configuration, cipher suites, and certificate chain
• Certificate inspection -- parse and display X.509 certificates (PEM or DER) with post-quantum algorithm support
• Diagnostics -- verify certificate chains, check expiration, detect misconfigurations

# Install
chmod +x spork-client-0.3.0-beta.11-linux-x86_64-installer
sudo ./spork-client-0.3.0-beta.11-linux-x86_64-installer

# Verify installation
spork --version

# Example usage
spork probe example.com:443
spork inspect /path/to/cert.pem

spork-ca

License: BSL-1.1

Installs the full CA management suite -- 8 binaries:

# Install
chmod +x spork-ca-0.3.0-beta.11-linux-x86_64-installer
sudo ./spork-ca-0.3.0-beta.11-linux-x86_64-installer

# Verify installation
spork-shell --version

spork-acme-server

License: BSL-1.1

Installs the spork-acme binary as a standalone ACME certificate authority. Compatible with certbot, acme.sh, Caddy, and any other ACME client.

# Install and set up in one step
chmod +x spork-acme-server-0.3.0-beta.11-linux-x86_64-installer
sudo ./spork-acme-server-0.3.0-beta.11-linux-x86_64-installer

The installer extracts the binary and automatically launches the interactive setup wizard. See the ACME Server Quick Start for platform-specific setup (firewall, SELinux, certbot).

spork-scep-server

License: BSL-1.1

Installs the spork-scep binary. SCEP (Simple Certificate Enrollment Protocol) is used for automated device enrollment, commonly by MDM solutions (Intune, Jamf, MobileIron).

# Install
chmod +x spork-scep-server-0.3.0-beta.11-linux-x86_64-installer
sudo ./spork-scep-server-0.3.0-beta.11-linux-x86_64-installer

# Verify installation
spork-scep --version

spork-est-server

License: BSL-1.1

Installs the spork-est binary. EST (Enrollment over Secure Transport, RFC 7030) provides certificate enrollment and renewal over HTTPS with mutual TLS authentication.

# Install
chmod +x spork-est-server-0.3.0-beta.11-linux-x86_64-installer
sudo ./spork-est-server-0.3.0-beta.11-linux-x86_64-installer

# Verify installation
spork-est --version

6. Post-Install Verification

After installation, verify the installed binaries are accessible and report the correct version:

# Client package
spork --version

# CA suite (check any or all)
spork-shell --version
spork-acme --version
spork-est --version
spork-scep --version
spork-ocsp --version

# Standalone server packages
spork-acme --version
spork-scep --version
spork-est --version

All binaries should report version 0.3.0-beta.11. If a binary is not found, ensure /usr/local/bin is in your PATH:

export PATH="/usr/local/bin:$PATH"

7. Uninstall

To remove SPORK components from your system:

Remove Binaries

# Remove client
sudo rm -f /usr/local/bin/spork

# Remove CA suite binaries
sudo rm -f /usr/local/bin/spork-shell
sudo rm -f /usr/local/bin/spork-acme
sudo rm -f /usr/local/bin/spork-est
sudo rm -f /usr/local/bin/spork-scep
sudo rm -f /usr/local/bin/spork-ocsp
sudo rm -f /usr/local/bin/spork-crl
sudo rm -f /usr/local/bin/spork-api
sudo rm -f /usr/local/bin/spork-tui

Stop and Remove systemd Services

# Stop services (if running)
sudo systemctl stop spork-acme.service 2>/dev/null
sudo systemctl stop spork-acme-crl.timer 2>/dev/null
sudo systemctl stop spork-est.service 2>/dev/null
sudo systemctl stop spork-scep.service 2>/dev/null
sudo systemctl stop spork-ocsp.service 2>/dev/null

# Disable services
sudo systemctl disable spork-acme.service 2>/dev/null
sudo systemctl disable spork-acme-crl.timer 2>/dev/null
sudo systemctl disable spork-est.service 2>/dev/null
sudo systemctl disable spork-scep.service 2>/dev/null
sudo systemctl disable spork-ocsp.service 2>/dev/null

# Remove service files
sudo rm -f /etc/systemd/system/spork-*.service
sudo rm -f /etc/systemd/system/spork-*.timer
sudo systemctl daemon-reload

Remove Data Directories

# Remove ACME server data
sudo rm -rf /opt/spork-acme/

# Remove general SPORK data
sudo rm -rf /var/lib/spork/