Getting Started with RLC

Root Library Catalog delivers patched packages for Python, JavaScript, Java, Go, .NET, and PHP. There are two ways to consume them:

Approach	How it works
Registry proxy	Point your package manager at `pkg.root.io`. Packages arrive patched on every install.
Patcher CLI	Run `rootio_patcher` against your existing environment. The CLI identifies vulnerable packages and replaces them with Root-patched versions.

This guide covers the registry proxy approach. See Root Patcher CLI for the CLI-based approach.

Prerequisites

1. Install the Root Patcher CLI

The Root Patcher CLI (rootio_patcher) is required to pull Root-secured packages into your environment.

# macOS (Apple Silicon)
curl -sL https://github.com/rootio-avr/rootio_patcher/releases/latest/download/rootio_patcher_darwin_arm64.tar.gz | tar xz
chmod +x rootio_patcher && sudo mv rootio_patcher /usr/local/bin/

# Linux (x86_64)
curl -sL https://github.com/rootio-avr/rootio_patcher/releases/latest/download/rootio_patcher_linux_x86_64.tar.gz | tar xz
chmod +x rootio_patcher && sudo mv rootio_patcher /usr/local/bin/

For macOS Intel and Windows, see the full installation instructions.

2. Set your API key

Get your API key from Settings → Token Management in the Root platform, then export it:

export ROOTIO_API_KEY="your-api-key-here"

3. Your standard package manager

Have pip, uv, Poetry, npm, pnpm, yarn, Maven, Go, the .NET SDK, or Composer already installed.

Python - pip, uv, Poetry

All Python tools authenticate via ~/.netrc:

echo "machine pkg.root.io login token password YOUR_ROOT_TOKEN" >> ~/.netrc
chmod 600 ~/.netrc

Then point your package manager at Root:

# pip
pip config set global.index-url https://pkg.root.io/pypi/simple &&
pip config set global.extra-index-url https://pypi.org/simple

# uv - add to pyproject.toml
# [[tool.uv.index]]
# name = "root"
# url = "https://pkg.root.io/pypi/simple/"

# Poetry
poetry source add --priority=primary root https://pkg.root.io/pypi/simple/ &&
poetry source add --priority=supplemental pypi

See the full Python guide for per-tool details and CI/CD configuration.

JavaScript - npm, pnpm, yarn

Root serves patched JavaScript packages under the @rootio/ scope. Authentication uses base64-encoded credentials:

npm config set registry https://pkg.root.io/npm/ --location=project &&
npm config set //pkg.root.io/npm/:_authToken YOUR_ROOT_TOKEN --location=project

Patched packages are applied via overrides in package.json - no changes to import statements needed:

{
  "dependencies": {
    "axios": "npm:@rootio/axios@1.6.0"
  },
  "overrides": {
    "axios": "npm:@rootio/axios@1.6.0"
  }
}

See the full JavaScript guide for pnpm, Yarn 1, and Yarn 3 variants.

Java - Maven

Configure ~/.m2/settings.xml to mirror Maven Central through Root:

<settings>
  <servers>
    <server>
      <id>root-io</id>
      <username>rootio</username>
      <password>${env.ROOT_TOKEN}</password>
    </server>
  </servers>
  <mirrors>
    <mirror>
      <id>root-io</id>
      <name>Root.io Mirror for All Maven Repositories</name>
      <url>https://pkg.root.io/maven/</url>
      <mirrorOf>central</mirrorOf>
    </mirror>
  </mirrors>
</settings>

Then export your token and run Maven as usual:

export ROOT_TOKEN="your-token-here"
mvn -U test

See the full Java guide for the complete settings.xml and CI/CD setup.

Go - Go modules

Configure GOPROXY to authenticate with Root’s module proxy:

export GOPROXY="https://:${ROOTIO_API_KEY}@pkg.root.io/gobinary,https://proxy.golang.org,direct"

Then use the Root Patcher CLI to add replace directives to your go.mod:

# Preview patches
rootio_patcher go remediate

# Apply patches
rootio_patcher go remediate --dry-run=false

# Build
go build ./...

The patcher adds entries like:

replace golang.org/x/net v0.17.0 => pkg.root.io/golang/golang.org/x/net v0.17.0-rootio.1

Your import statements remain unchanged - the replace directives transparently redirect module resolution to Root’s patched versions. See the full Go guide for checksum verification, multi-module projects, and CI/CD setup.

.NET - NuGet

Add Root as a NuGet package source:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="root-io" value="https://pkg.root.io/nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <root-io>
      <add key="Username" value="root" />
      <add key="ClearTextPassword" value="YOUR_ROOT_TOKEN" />
    </root-io>
  </packageSourceCredentials>
</configuration>

Then use the patcher to apply Root-patched package versions (aliased RootIO.* form):

# Preview patches
rootio_patcher nuget remediate

# Apply patches - rewrites PackageReference to RootIO.* aliased names
rootio_patcher nuget remediate --dry-run=false

# Restore and build
dotnet restore && dotnet build

See the full NuGet guide for CI/CD configuration and troubleshooting.

PHP - Composer ^Beta

Use the Root Patcher CLI to analyze your composer.lock, update composer.json with patched version constraints, and run composer update to apply patches:

# Preview patches - no ROOTIO_API_KEY needed
rootio_patcher composer remediate

# Apply patches
export COMPOSER_AUTH='{"http-basic":{"pkg.root.io":{"username":"","password":"your-api-key"}}}'
rootio_patcher composer remediate --dry-run=false

The patcher adds pkg.root.io/composer/ as a Composer repository and pins affected packages to their patched versions. The vendor/ directory is fully populated after the patcher runs — no separate composer install needed.

composer.lock must exist before running the patcher. Run composer install first if it is missing. Future composer install runs in CI/CD require COMPOSER_AUTH to be set so Composer can fetch patched packages from pkg.root.io/composer/.

See the full Composer guide for CI/CD configuration and troubleshooting.

Getting Started

Root Image Catalog

Platform

Integrations

AI Integrations

Root Library Catalog

Core Concepts

Reports & Insights

Reference

Trust & Compliance

Getting Started with RLC

Prerequisites

1. Install the Root Patcher CLI

2. Set your API key

3. Your standard package manager

Python - pip, uv, Poetry

JavaScript - npm, pnpm, yarn

Java - Maven

Go - Go modules

.NET - NuGet

PHP - Composer ^Beta

​Prerequisites

​1. Install the Root Patcher CLI

​2. Set your API key

​3. Your standard package manager

​Python - pip, uv, Poetry

​JavaScript - npm, pnpm, yarn

​Java - Maven

​Go - Go modules

​.NET - NuGet

​PHP - Composer Beta

Prerequisites

1. Install the Root Patcher CLI

2. Set your API key

3. Your standard package manager

Python - pip, uv, Poetry

JavaScript - npm, pnpm, yarn

Java - Maven

Go - Go modules

.NET - NuGet

PHP - Composer ^Beta