What you need before you build

Rust, plus one platform-specific thing. Two widely-assumed prerequisites are not required, and knowing that saves a wasted afternoon.

A Rust toolchain

Install from rustup.rs. The repository ships a rust-toolchain.toml that pins the stable channel plus the rustfmt and clippy components — note that it pins a channel, not a fixed version number, so rustup will fetch or reuse whatever current stable you have. The workspace declares edition = "2021" and a minimum supported Rust version of 1.75; a compiler older than that fails with a Cargo message naming rust-version.

On Windows: MSVC, not GNU

Install the Visual Studio Build Tools with the "Desktop development with C++" workload before you build. MSVC (x86_64-pc-windows-msvc) is the supported Windows target. The TLS stack (rustls over aws-lc-rs, reached through tovio-proto's transport feature) cannot link under the GNU toolchain, and the failure surfaces as a wall of linker errors that look unrelated to the real cause.

The self-contained GNU toolchain remains best-effort for the offline core only — tovio-core, tovio-cli, tovio-keystore, and tovio-proto with default features. That is enough to try local version control without networking. It is not the supported configuration, and clone, sync, push, pull and serve are not part of it.

On Linux: a C compiler, and nothing else

You need a working C compiler (cc, from build-essential or your distribution's equivalent). The Linux keychain backend is built with libdbus vendored — it compiles libdbus from bundled source rather than linking the system library through pkg-config.

The consequence is the useful part: you do not need libdbus-1-dev, and you do not need libsecret development headers. Guides that tell you to install them are describing an older arrangement. Vendoring was adopted because CI runners do not ship those packages, and it removed the prerequisite for local builds at the same time.

On macOS

The Xcode command line tools (xcode-select --install). Keychain integration uses Apple Keychain Services and needs nothing extra.

What the keychain is actually for

Worth being precise about, because it changes what you need on a server. TOVIO does not put your private key in the OS keychain. The identity secret is sealed on disk inside the repository, at .tovio/identity/default.key, and the keychain holds only the 32-byte wrapping key that unseals it. Both halves are needed, and neither is useful alone.

That also means a machine with no keychain daemon at all — a container, a CI runner, a headless server — is a configuration you set up deliberately rather than something that resolves itself. There is no automatic on-disk fallback. See the headless-host article for the environment variables involved.

There is no OpenSSL dependency

TLS is rustls, not OpenSSL. There is no system OpenSSL to install, no OPENSSL_DIR to set, and nothing to link — that is what keeps the single-static-binary goal intact. Tools like mkcert or openssl come up only if you want to mint a development certificate for running a local Forge, never to build the CLI.

If you plan to work on the repository itself

The lint and format gates are part of CI, so match them locally: cargo fmt, and cargo clippy --workspace --all-targets -- -D warnings. Warnings are errors in CI, so a clean local clippy run is worth having before you push.