Path A — Self-host the server
One small Go binary. All six tools are baked in via //go:embed; the server picks the right one for each folder of your archive. Adds ACL via .zddc files, the virtual .archive document index, and SSO header passthrough. Stop the server and the directory is still a perfectly valid ZDDC archive — the server is convenience, not lock-in.
After download: chmod +x the file, set ZDDC_ROOT=/path/to/archive, run.
Need a different platform? Build from source at the matching tag.
Path B — Standalone tools
Every tool is a single self-contained HTML file. Open it locally and point it at a folder on your disk — no install, no server, no account. Same on-disk layout the server uses. Use one tool, use all six, mix and match — there is no orchestration to set up.
Your version, forever
Your server may run v0.0.8 next month and v0.1.0 the month after. Your project doesn't have to follow. If you depend on a specific behavior in archive v0.0.5, save that version into your archive — the next server upgrade can't take it away from you. Two ways to do it:
Drop a copy into your archive
Save the tool's HTML at the path the server would serve it from. The server's resolution order picks up real files first — before any cascade or embedded fallback.
curl -o MyProject/archive.html \ https://zddc.varasys.io/releases/archive_v0.0.42.html
Now MyProject/archive.html is yours. The server serves your bytes; nothing about a future --release can change them.
Put it in the policy bundle
Tidier on a big tree — one .zddc.zip beside a directory can carry the tool for that whole subtree, so the pinned copy doesn't sit next to your documents.
curl -o archive.html \ https://zddc.varasys.io/releases/archive_v0.0.42.html zip MyProject/.zddc.zip archive.html
Resolution order is: a real archive.html on disk → an archive.html member of the .zddc.zip → the copy baked into the server. No fetching, no cache, nothing to go stale.
Your archive's tools are yours. The server is convenience; deletion of the server doesn't break your archive — every per-version download above is a real, immutable static file. Save what you trust.
Verify your downloads
Every artifact published here is signed with a long-lived Ed25519 key. You can verify any download against the public key using stock openssl — no special tooling. Verification is yours to run: the bytes you save are the bytes you checked, and nothing about a later release can change them.
Public key
SHA-256 fingerprint of the DER-encoded SubjectPublicKeyInfo:
7766dc8cf963f32156ddcc96825c52ba0333ffe4c243ad54f9eaf26195b065ab
Verify the fingerprint after downloading:
openssl pkey -pubin -in pubkey.pem -outform DER | sha256sum
Verify a download
Each artifact has a matching .sig file alongside it (archive.html → archive.html.sig, etc.). Fetch both, then:
curl -O https://zddc.varasys.io/releases/archive.html
curl -O https://zddc.varasys.io/releases/archive.html.sig
openssl pkeyutl -verify -pubin -inkey pubkey.pem \
-rawin -in archive.html \
-sigfile archive.html.sig
Output is Signature Verified Successfully on a clean download. Any other output (or no output and a non-zero exit) means the bytes do not match the published signature — do not trust them.