Open-source, written in Rust

A static site generator that checks what it builds

ssg turns Markdown and templates into a site, scores every build on a ten-pillar quality gate, and audits the output on fifteen gates, from WCAG to CSP, SRI, links and feeds.

From nothing to a built site
cargo install ssg

# Scaffold a project (legacy form, still supported)
ssg -n mysite
cd mysite

# Build into public/, then audit it
ssg build -f config.toml
ssg audit -o public -f config.toml

What ssg 0.0.69 ships

Counted from the 0.0.69 binary and its GitHub release.

10 / 10
Quality-gate pillars this site passes
15
Audit gates
6
Subcommands
1.89
Minimum Rust version

What it does

A generator that checks the site it builds

Each card opens its section on the features page.

A quality gate on every build

Every build scores the site on ten pillars and reports each issue it finds, page by page.

What the gate checks

Fifteen audit gates

ssg audit checks the built files: WCAG, structured data, CSP and SRI, links, metadata, feeds, images and more.

See the gates

CSP and Subresource Integrity

Inline styles and scripts move to hashed files, and every local stylesheet and script carries an integrity hash.

How pages are hardened

Content schemas

Declare the front matter each page must carry, and the build stops with a named error when a field is missing.

How schemas work

RSS, Atom and JSON feeds, sitemaps, a search index and llms.txt come out of the same build.

What a build writes

One-command deploys

ssg deploy builds and ships to Netlify, Vercel, Cloudflare Pages, GitHub Pages or S3.

Deploy targets

Commands

Build, check, audit

Three of the six subcommands in ssg 0.0.69.

ssg build

Build the site

Compiles Markdown content with templates into the output directory and runs the quality gate.

All subcommands

ssg check

Validate without writing

Runs the content, accessibility, SEO, JSON-LD and CSP checks and writes no output.

All subcommands

ssg audit

Audit the result

Runs the fifteen gates against the built files and exits non-zero on an error.

The fifteen gates

Security

Releases you can verify

Every release package comes with a SHA-256 sum, an OpenPGP signature and a build provenance attestation.

The signing key is in KEYS.asc in the repository. Release packages are built for Linux and macOS on x86_64 and arm64 and for Windows on x86_64: .tar.gz archives, a .zip and an .msi, .deb and .rpm packages and a macOS .pkg. The crate is on crates.io. The security page shows how to check an archive before you run it, and how to report a vulnerability.

SHA-256
Checksums
OpenPGP
Signatures
SLSA
Build provenance
MIT or Apache-2.0
Licence

What is Static Site Generator?

Static Site Generator, or ssg, is a free, open-source static site generator written in Rust by Sebastien Rousseau. It compiles Markdown content with HTML templates into a site, and checks the result as it goes: a ten-pillar quality gate on every build, and fifteen audit gates you can run on the output, covering accessibility, structured data, the content security policy, Subresource Integrity, links, metadata and feeds. It is dual-licensed under MIT or Apache-2.0, and this site is built with it.

How do I install it?

cargo install ssg

or download a signed package from the GitHub releases. The getting started guide goes from there to a built and audited site.

Where is the reference?

The API reference is at docs.static-site-generator.com, the themes at themes.static-site-generator.com, and the source, the issue tracker and every release at GitHub.

Formerly Shokunin

Until version 0.0.36 the project was called Shokunin. The crate and the command were always ssg; the Formerly Shokunin page maps the old flags to the current subcommands.