Skip to content

Installation

hemlock ships as a single static binary with no runtime dependencies. Choose the installation method that fits your workflow.

Requirements

Dependency Version Notes
Go 1.25+ Required for go install and building from source
Make Any Optional; used for build and release targets
Git Any Required only when building from source

The fastest path from zero to running:

go install github.com/professor-moody/hemlock/cmd/hemlock@latest

This compiles the binary and places it in your $GOPATH/bin directory. Ensure that directory is on your PATH:

export PATH="$PATH:$(go env GOPATH)/bin"

Pin a version

To install a specific release, replace @latest with a version tag:

go install github.com/professor-moody/hemlock/cmd/hemlock@v1.0.0

Build from Source

Clone the repository and build with Make:

git clone https://github.com/professor-moody/hemlock.git
cd hemlock
make build

The binary is written to ./hemlock in the project root.

git clone https://github.com/professor-moody/hemlock.git
cd hemlock
go build -o hemlock ./cmd/hemlock

Move the binary to a directory on your PATH, or run it directly:

./hemlock --help

Cross-Compilation

The Makefile includes a release target that produces binaries for three platforms:

make release

This creates the following binaries in the dist/ directory:

File Platform
dist/hemlock-linux-amd64 Linux x86_64
dist/hemlock-darwin-arm64 macOS Apple Silicon
dist/hemlock-windows-amd64.exe Windows x86_64

Custom targets

To build for a platform not covered by the release target, set GOOS and GOARCH directly:

GOOS=linux GOARCH=arm64 go build -o dist/hemlock-linux-arm64 ./cmd/hemlock

Verify Installation

Confirm hemlock is installed and accessible:

hemlock --help

Expected output:

hemlock — RAG pipeline poisoning document generator

Generates documents with hidden prompt injection payloads for testing
RAG pipeline security. Operationalizes PoisonedRAG and PhantomText research.

Usage:
  hemlock [command]

Available Commands:
  batch            Generate full document set (all formats x all techniques)
  completion       Generate the autocompletion script for the specified shell
  craft            Generate poisoned documents
  help             Help about any command
  list-payloads    List available preset payloads
  list-techniques  List available hiding techniques
  validate         Test if payloads survive RAG processing

Flags:
  -h, --help   help for hemlock

Use "hemlock [command] --help" for more information about a command.

Ready to go

If you see the help output above, hemlock is installed correctly. Continue to the Quickstart to generate your first poisoned documents.

Uninstalling

Remove the binary from your Go bin directory:

rm "$(go env GOPATH)/bin/hemlock"

Remove the binary and optionally the cloned repository:

rm ./hemlock          # or wherever you placed it
rm -rf ./hemlock/     # remove the source directory

If you ran make release, also clean up the dist/ directory:

make clean