Skip to main content

Install Vendorzo

Vendorzo is distributed as a signed source artifact for Merchant or Marketplace. The standard release archive contains the application under web/. Verify the archive before extracting it, using a trusted verifier and public key supplied separately from the archive or retained from a previously verified release. Do not trust a verifier taken only from the unverified archive.

php /path/to/trusted/verify-edition-archive.php \
  --archive=/path/to/vendorzo-release.tar.gz \
  --signature=/path/to/vendorzo-release.tar.gz.sig \
  --public-key=/path/to/vendorzo-release.pub

After the signature check succeeds, extract to a new, empty release directory and verify the signed artifact manifest for the intended edition:

mkdir -m 0750 /path/to/releases/vendorzo-release
tar -xzf /path/to/vendorzo-release.tar.gz -C /path/to/releases/vendorzo-release
php /path/to/releases/vendorzo-release/web/scripts/verify-edition-artifact.php \
  --path=/path/to/releases/vendorzo-release/web \
  --public-key=/path/to/vendorzo-release.pub \
  --edition=merchant

Use --edition=marketplace for a Marketplace artifact. Stop if either check fails or the artifact edition differs from the deployment plan. Keep the archive, detached signature, key, and verification output together as release evidence.

Requirements​

  • PHP 8.2 or later within the supported range in the compatibility matrix.
  • PHP Sodium support for verifying Vendorzo's Ed25519 release signatures.
  • The PHP extensions required by the release's composer.lock.
  • A supported MySQL or MariaDB database and writable storage/ and bootstrap/cache/ directories.
  • A separate database, cache prefix, queue, and storage location for each installation.

Use the .env.example supplied with the exact release. Configure database credentials, APP_URL, mail, queue, and storage. Leave APP_KEY empty until the fresh-install key-generation step. Set COMMERCE_EDITION and MARKETPLACE_PACKAGE_INSTALLED to match the artifact.

Install​

The verified artifact includes its locked Composer dependencies. Work from its web/ directory and copy .env.example to .env. Configure the database, application URL, mail, queue, storage, and edition values. The complete signed release already contains its locked dependencies; stop if vendor/autoload.php is missing instead of resolving packages from an untrusted source. On a fresh install, generate a new application key, then run:

cd /path/to/releases/vendorzo-release/web
cp .env.example .env
php artisan key:generate --force
php artisan migrate --force
php artisan merchant:install --admin-email=replace-with-your-named-admin@example.com
php artisan commerce:edition-check
php artisan optimize

Replace the example administrator address with a named administrator's real address. The installer prompts for the initial administrator password when no administrator exists. It enforces a strong password and requires a password change at first login; there is no shipped default password. The first install imports bundled India PIN data and leaves checkout disabled and the storefront in Coming Soon. Complete initial setup, verify the edition and complete the launch checklist before opening the store.

Marketplace installs must use the Marketplace artifact and its package-enabled environment values. Changing the edition setting without installing the package and applying migrations does not upgrade a Merchant installation.

Licensed updates​

For an existing installation, follow Upgrade Vendorzo. Do not run key:generate again, replace the existing .env, or extract a new release over the active code directory. Certificate verification uses a customer certificate public key that is separate from the release signing key. Keep software connection credentials in protected private storage; do not paste them into a ticket, log, shell history, or source-control file.

Before accepting orders​

Configure the scheduler and queue workers for enabled features. In an isolated test setup, verify the homepage, product page, cart, administrator login, health endpoint, storage permissions, mail, and payment/shipping sandbox workflows. Take a database and media backup and verify the restore procedure before importing production data or enabling live transactions.

Keep the signed archive, detached signature, and trusted release public key for independent verification. Do not extract over a live installation.

Last updated on