{"id":37177125,"url":"https://github.com/balibuild/bali","last_synced_at":"2026-01-14T20:39:45.377Z","repository":{"id":38366962,"uuid":"255576054","full_name":"balibuild/bali","owner":"balibuild","description":"Bali -  Minimalist Golang build and packaging tool","archived":false,"fork":false,"pushed_at":"2026-01-12T06:36:52.000Z","size":954,"stargazers_count":68,"open_issues_count":1,"forks_count":4,"subscribers_count":1,"default_branch":"master","last_synced_at":"2026-01-12T16:31:59.823Z","etag":null,"topics":["build","darwin","golang","installer","interesting","linux","package","posix","windows"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/balibuild.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2020-04-14T10:15:14.000Z","updated_at":"2026-01-12T06:36:48.000Z","dependencies_parsed_at":"2023-11-16T07:34:20.438Z","dependency_job_id":"7514d153-0f6b-4ec1-8758-1d0d0e9ab137","html_url":"https://github.com/balibuild/bali","commit_stats":null,"previous_names":[],"tags_count":27,"template":false,"template_full_name":null,"purl":"pkg:github/balibuild/bali","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/balibuild%2Fbali","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/balibuild%2Fbali/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/balibuild%2Fbali/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/balibuild%2Fbali/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/balibuild","download_url":"https://codeload.github.com/balibuild/bali/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/balibuild%2Fbali/sbom","scorecard":{"id":144853,"data":{"date":"2025-08-11","repo":{"name":"github.com/balibuild/bali","commit":"4be16428595c8d6480a9ba68316754a81879efe1"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4,"checks":[{"name":"Code-Review","score":0,"reason":"Found 0/2 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":10,"reason":"19 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/balibuild/bali/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/balibuild/bali/ci.yml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/balibuild/bali/ci.yml/master?enable=pin","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v3.1.1 not signed: https://api.github.com/repos/balibuild/bali/releases/225380119","Warn: release artifact v3.1.0 not signed: https://api.github.com/repos/balibuild/bali/releases/172923246","Warn: release artifact v3.0.1 not signed: https://api.github.com/repos/balibuild/bali/releases/172898257","Warn: release artifact v3.0.0 not signed: https://api.github.com/repos/balibuild/bali/releases/172894061","Warn: release artifact v2.2.1 not signed: https://api.github.com/repos/balibuild/bali/releases/155614028","Warn: release artifact v3.1.1 does not have provenance: https://api.github.com/repos/balibuild/bali/releases/225380119","Warn: release artifact v3.1.0 does not have provenance: https://api.github.com/repos/balibuild/bali/releases/172923246","Warn: release artifact v3.0.1 does not have provenance: https://api.github.com/repos/balibuild/bali/releases/172898257","Warn: release artifact v3.0.0 does not have provenance: https://api.github.com/repos/balibuild/bali/releases/172894061","Warn: release artifact v2.2.1 does not have provenance: https://api.github.com/repos/balibuild/bali/releases/155614028"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 28 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-16T09:11:18.262Z","repository_id":38366962,"created_at":"2025-08-16T09:11:18.262Z","updated_at":"2025-08-16T09:11:18.262Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28434486,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T18:57:19.464Z","status":"ssl_error","status_checked_at":"2026-01-14T18:52:48.501Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["build","darwin","golang","installer","interesting","linux","package","posix","windows"],"created_at":"2026-01-14T20:39:44.616Z","updated_at":"2026-01-14T20:39:45.348Z","avatar_url":"https://github.com/balibuild.png","language":"Go","readme":"# Bali -  Minimalist Golang build and packaging tool\n\n[![Master Branch Status](https://github.com/balibuild/bali/workflows/CI/badge.svg)](https://github.com/balibuild/bali/actions)\n\n\n[简体中文](./README.zh-CN.md)\n\nBali is a *minimal Golang build and packaging tool* developed using Golang.\n\n## Feature\n\nBali has some functions that I think are useful:\n\n+ Build parameters support derivation of environment variables\n+ Package, create compressed package, support `rpm`, `tar`, `zip`, `sh`.\n+ The Windows platform supports embedded version information, icons, and application manifest.\n\nrpm supported compression:\n+ gzip\n+ zstd\n+ lzma\n+ xz\n\ntar supported compression:\n+ none   --\u003e pure tar\n+ gzip   --\u003e tar.gz\n+ zstd   --\u003e tar.zst\n+ xz     --\u003e tar.xz\n+ bzip2  --\u003e tar.bz2\n+ brotli --\u003e tar.br\n\nsh supported compression:\n+ none   --\u003e pure tar\n+ gzip   --\u003e tar.gz\n+ zstd   --\u003e tar.zst\n+ xz     --\u003e tar.xz\n+ bzip2  --\u003e tar.bz2\n\nzip supported compression:\n+ deflate\n+ zstd\n+ bzip2\n+ xz\n\n\nBali's command line help information is as follows:\n\n```txt\nUsage: bali \u003ccommand\u003e [flags]\n\nBali - Minimalist Golang build and packaging tool\n\nFlags:\n  -h, --help             Show context-sensitive help.\n  -M, --module=\".\"       Explicitly specify a module directory\n  -B, --build=\"build\"    Explicitly specify a build directory\n  -V, --verbose          Make the operation more talkative\n  -v, --version          Print version information and quit\n\nCommands:\n  build     Compile the current module (default)\n  update    Update dependencies as recorded in the go.mod\n  clean     Remove generated artifacts\n\nRun \"bali \u003ccommand\u003e --help\" for more information on a command.\n\n\n```\n\nbali build command:\n\n```txt\nUsage: bali build [flags]\n\nCompile the current module (default)\n\nFlags:\n  -h, --help                  Show context-sensitive help.\n  -M, --module=\".\"            Explicitly specify a module directory\n  -B, --build=\"build\"         Explicitly specify a build directory\n  -V, --verbose               Make the operation more talkative\n  -v, --version               Print version information and quit\n\n  -T, --target=\"windows\"      Target OS for which the code is compiled\n  -A, --arch=\"amd64\"          Target architecture for which the code is compiled\n      --release=STRING        Specifies the rpm package tag version\n  -D, --destination=\"dest\"    Specify the package save destination\n      --pack=PACK,...         Packaged in a specific format. supported: zip,\n                              tar, sh, rpm\n      --compression=STRING    Specifies the compression method\n```\n\n\n## Instructions\n\nCommon build:\n\n```shell\ncd /path/to/project\nbali\n```\n\nCreate `Tar.gz` compressed package:\n\n```shell\nbali --pack=tar\n```\n\nCreate `STGZ` installation package, mainly used on Linux/macOS platform:\n\n```shell\nbali --pack=sh --target=linux --arch=amd64\n```\n\nOutput the installation package to the specified directory:\n\n```shell\nbali --pack=rpm --target=linux --arch=amd64 --dest=/tmp/output\n```\n\nCreate multiple packages at once:\n\n```shell\nbali --target=linux --arch=arm64 '--pack=sh,rpm,tar' \n```\n\n## Bali build file format\n\nProject file `bali.toml`:\n\n```toml\n# https://toml.io/en/\nname = \"bali\"\nsummary = \"Bali - Minimalist Golang build and packaging tool\"\ndescription = \"Bali - Minimalist Golang build and packaging tool\"\npackage-name = \"bali-dev\"\nversion = \"3.1.2\"\nlicense = \"MIT\"\nprefix = \"/usr/local\"\ncrates = [\n    \"cmd/bali\",     # crates\n    \"cmd/peassets\",\n]\n\n[[include]]\npath = \"LICENSE\"\ndestination = \"share\"\nrename = \"BALI-COPYRIGHT.txt\"\npermissions = \"0664\"\n\n```\n\nBuilt-in environment variables:\n\n+ `BUILD_VERSION` is filled by the `version` field of balisrc.json\n+ `BUILD_TIME` is filled by the build time formatted according to `RFC3339`\n+ `BUILD_COMMIT` is filled by the commit id of the repository (when it is a git repository)\n+ `BUILD_GOVERSION` is filled by `go version` output (removed `go version` prefix)\n+ `BUILD_BRANCH` is filled with the branch name of the repository (when it is a git repository)\n\nOther environment variables can be used in goflags.\n\nProgram build file `crate.toml`:\n\n```toml\nname = \"bali\"\ndescription = \"Bali - Minimalist Golang build and packaging tool\"\ndestination = \"bin\"\nversion = \"3.1.2\"\ngoflags = [\n    \"-ldflags\",\n    \"-X 'main.VERSION=$BUILD_VERSION' -X 'main.BUILD_TIME=$BUILD_TIME' -X 'main.BUILD_BRANCH=$BUILD_BRANCH' -X 'main.BUILD_COMMIT=$BUILD_COMMIT'  -X 'main.BUILD_REFNAME=$BUILD_REFNAME' -X 'main.BUILD_GOVERSION=$BUILD_GOVERSION'\",\n]\n\n```\n\nWindows-related manifest files (crate.toml sibling)：`winres.toml:`\n\n```toml\nicon = \"res/bali.ico\" # data:base64-content\nmanifest = \"\"\"data:\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\n\u003cassembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\" xmlns:asmv3=\"urn:schemas-microsoft-com:asm.v3\"\u003e\n  \u003cdescription\u003eBali\u003c/description\u003e\n  \u003ctrustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\"\u003e\n    \u003csecurity\u003e\n      \u003crequestedPrivileges\u003e\n        \u003crequestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\" /\u003e\n      \u003c/requestedPrivileges\u003e\n    \u003c/security\u003e\n  \u003c/trustInfo\u003e\n  \u003ccompatibility xmlns=\"urn:schemas-microsoft-com:compatibility.v1\"\u003e\n    \u003capplication\u003e\n      \u003c!-- Windows 10 --\u003e\n      \u003csupportedOS Id=\"{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}\"/\u003e\n    \u003c/application\u003e\n  \u003c/compatibility\u003e\n  \u003casmv3:application\u003e\n    \u003casmv3:windowsSettings xmlns=\"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\u003e\n      \u003clongPathAware xmlns=\"http://schemas.microsoft.com/SMI/2016/WindowsSettings\"\u003etrue\u003c/longPathAware\u003e\n    \u003c/asmv3:windowsSettings\u003e\n  \u003c/asmv3:application\u003e\n\u003c/assembly\u003e\n\"\"\"\n\n[FixedFileInfo]\nFileFlagsMask = \"3f\"\nFileFlags = \"00\"\nFileOS = \"40004\"\nFileType = \"01\"\nFileSubType = \"00\"\n\n[FixedFileInfo.FileVersion]\nMajor = 0\nMinor = 0\nPatch = 0\nBuild = 0\n\n[FixedFileInfo.ProductVersion]\nMajor = 0\nMinor = 0\nPatch = 0\nBuild = 0\n\n[StringFileInfo]\nComments = \"\"\nCompanyName = \"Bali Team\"\nFileDescription = \"Bali - Minimalist Golang build and packaging tool\"\nFileVersion = \"\"\nInternalName = \"bali.exe\"\nLegalCopyright = \"Copyright © 2025. Bali contributors\"\nLegalTrademarks = \"\"\nOriginalFilename = \"bali.exe\"\nPrivateBuild = \"\"\nProductName = \"Bali\"\nProductVersion = \"\"\nSpecialBuild = \"\"\n\n[VarFileInfo]\n[VarFileInfo.Translation]\nLangID = \"0409\"\nCharsetID = \"04B0\"\n\n```\n\n\nBali integrates [`goversioninfo`](https://github.com/josephspurrier/goversioninfo). When the target is Windows, it can embed version information (`winres.toml`) into the executable program.\n\nThe benefits of adding a reference program manifest are self-evident. For example, Windows UAC privilege escalation, Windows 10 long path support (ie path support\u003e 260 characters), Windows Vista style controls, TaskDialog, DPI settings, etc. all need to modify the application manifest.\n\n## Bootstrap\n\nUsually after installing and configuring the Golang environment, you can follow the following command to complete Bali's bootstrapping:\n\nUNIX:\n\n```shell\n./script/bootstrap.sh\n```\n\nWindows:\n\n```ps1\n# powershell\npwsh ./script/bootstrap.ps1\n# cmd\nscript/bootstrap.bat\n```\n\n\n## Github Actions Use bali\n\n```\ngo install github.com/balibuild/bali/v3/cmd/bali@latest\n```\n\n## Thanks\n\nBali's ability to automatically add version information to PE files is inseparable from the contribution of open source projects. Thank you very much [akavel/rsrc](https://github.com/akavel/rsrc) and [josephspurrier/goversioninfo](https://github.com/josephspurrier/goversioninfo) Developer and maintainer of two projects.\n\nThe Bali Github organization and Bali's own icons come from [www.flaticon.com](https://www.flaticon.com/) The creator is [Smashicons](https://www.flaticon.com/authors/smashicons) .\n\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbalibuild%2Fbali","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbalibuild%2Fbali","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbalibuild%2Fbali/lists"}