RiaCore

RiaCore: Modernize Your Safety Engineering Workflow

⬇ Download RiaCore

Ready-to-run apps for Windows, macOS, and Linux — no build required. Open the releases page above and download the package for your platform. Then follow Getting Started with Sample Data.

Struggling to bridge the gap between complex system design and rigorous safety standards? RiaCore is an open-source toolkit designed to streamline your safety analysis process, making safety engineering more accessible, collaborative, and structured.

Built with the systems engineer in mind, RiaCore transforms fragmented documentation into a cohesive, analysis-ready framework. Whether you are managing safety goals, defining system requirements, or architecting complex software, RiaCore provides the environment you need to keep your development lifecycle compliant and efficient.

Why choose RiaCore?

Stop wrestling with disconnected spreadsheets and manual tracking. Empower your team with a tool built for the modern safety lifecycle—check out RiaCore.

Installation

You do not need to build anything to try RiaCore. Prebuilt applications are published in the Releases section of the main repository:

The Windows installer and portable app bundle the Microsoft Visual C++ runtime used by the database module. No separate Visual C++ Redistributable installation is required.

Grab the package for your platform, start the app, and continue with Getting Started with Sample Data.

If you would like to build RiaCore from source, see Building from source below.

The macOS app bundles OpenSSL 3, Node.js and Git; Homebrew is not required to run it. The Windows version requirement follows the bundled Node.js 24 runtime and Electron.

The additional native runtime notices ship as THIRD-PARTY-NOTICES.txt in the packaged application’s resources directory. macOS packages also include the OpenSSL license and attribution files in native-libs/; Windows packages record their unmodified Visual C++ runtime files in node-sidecar/vc-runtime.json.

Public RiaCore releases are GPL-3.0-or-later. Each desktop package contains the full GPL text as resources/LICENSE (macOS: Contents/Resources/LICENSE) and an attribution notice in licenses/RiaCore-COPYRIGHT.txt. Release generation adds this license to the filtered public source tree; it does not add a root license or change the licensing of the private RiaCoreDev repository.

The package’s licenses/THIRD-PARTY-LICENSES.txt indexes copied upstream licenses and notices for backend npm packages, the renderer’s runtime dependency graph (including fonts), Node.js, Electron/Chromium and native components. licenses/inventory.json records versions, origins, upstream attribution and document checksums; licenses/SOURCE-CODE.txt points to release and upstream source locations. Dependencies retain their own licenses.

In packaged apps, Help → Licenses and Notices opens these documents.

Screenshots

RiaCore desktop app — namespace tree and analysis view

RiaCore desktop app — safety analysis working area

Getting Started with Sample Data

The fastest way to get something on screen is the reference project: github.com/cntSafety/ref-project.

It ships a ready-to-use workspace — importer configs, sample source data (ARXML, SysML, and more), and persisted ria-data — so you can open it directly in RiaCore instead of assembling a workspace and import configuration by hand.

git clone https://github.com/cntSafety/ref-project.git

Then point RiaCore at the cloned directory as its working directory and load the data from there.

⚠️ Qualification notice

No tool qualification is provided with RiaCore. Before using it in any project, the qualification has to be performed according to that project’s specific requirements and the applicable safety standards — for example ISO 26262, IEC 61508, or others relevant to your domain. Deciding on the required qualification measures, performing them, and documenting the evidence remains the responsibility of the using project.

Where data lives

For a given working directory:

⚠️ Keep the database and logs out of git. ria-data/ is the versioned artifact — the full graph state lives in those JSON files and can be restored into a fresh database at any time. The db/ directory is a regenerable binary cache, and logs are runtime noise; committing either bloats the repository and produces meaningless diffs. Add this to the .gitignore of your workspace repository:

# Logs
*.log
logs/

# Database files
db
db.wal
*.db
*.db.wal

Building from source

Only needed if you want to develop RiaCore or build your own packages. For normal use, take a prebuilt application from the Releases section instead.

Prerequisites

Setup

cd RiaCoreDev
pnpm install
pnpm build

⚠️ Git binary for packaging: The pnpm install step downloads a bundled git binary via the dugite package (used by @riacore/git-service). If the download fails (e.g. due to a corporate proxy or TLS certificate issue with error UNABLE_TO_GET_ISSUER_CERT_LOCALLY), the app will not work — both in packaged builds and during local development. To fix this, either set NODE_EXTRA_CA_CERTS to your corporate CA certificate before running pnpm install, or manually download the dugite-native release from GitHub and extract it into node_modules/.pnpm/dugite@2.7.1/node_modules/dugite/git/.

Run in development (Electron)

From the repo root, a single command starts both the Vite dev server and Electron:

cd RiaCoreDev
pnpm dev

This works on Windows, macOS, and Linux. It starts the renderer dev server, waits until it’s ready on http://localhost:5173, then launches Electron automatically. Closing either process shuts both down.

If you see ERR_CONNECTION_REFUSED, the dev server hasn’t finished starting yet — it will retry automatically.

Desktop Packaging

Native desktop packages are built on each target OS separately. Do not try to package macOS or Linux artifacts on Windows.

Current release target matrix:

The packaged desktop app bundles a platform-specific Node sidecar because the LadybugDB-backed worker must run under standard Node.js rather than Electron’s ABI-modified runtime.

On macOS, an afterPack hook copies non-system native library dependencies into the app and rewrites their load paths before signing. Package validation checks native dependency paths and signatures, enforces the macOS 26.0 minimum, and runs an in-memory database query using the bundled Node runtime on every platform. A clean-machine smoke test is still needed to verify feature-specific dependencies loaded dynamically.

On Windows, the hook bundles the Visual C++ release runtime using Microsoft’s local deployment mechanism. Validation checks that its x64 DLLs are present and unchanged from the redistributable source. Update the build machine’s Visual C++ redistributable libraries and rebuild RiaCore to deliver runtime updates; these app-local copies are shipped with RiaCore releases.

Windows distributors must use a validly licensed Visual Studio or Build Tools installation and comply with that edition’s redistribution terms. The runtime notices and checksums do not grant a license or verify the distributor’s entitlement. Runtime discovery through vswhere excludes preview installations by default; do not point the explicit redistributable-directory override at debug or preview components.

License collection runs during staging and again after electron-builder assembles the final package. Release validation rejects missing license entries, altered or missing license texts, unreviewed npm license declarations, and native component versions outside the reviewed inventory in apps/desktop-host/build/third-party/. Update version-specific upstream evidence when these dependencies change. Archives that declare MIT but omit a separate license file retain the publisher’s declaration and author metadata alongside canonical license terms; the collector never invents copyright years or assumes a license for undeclared packages. The spreadsheet ZIP reader’s legacy buffers dependency is therefore mapped to the explicitly MIT-licensed node-buffers fork.

Build from the repo root:

pnpm package:desktop:win
pnpm package:desktop:mac
pnpm package:desktop:linux

Generated paths:

Distribution artifacts are written to apps/desktop-host/dist-electron/ by electron-builder, for example:

asar is currently disabled for packaged builds because the external Node worker cannot reliably load its runtime modules from app.asar.

This site is open source. Improve this page.