DevGrail
All releases

v0.4.1

Signedpublished August 14, 2026

What changed

Fixed

  • An interrupted install could wedge every later run. The concurrency lock is held on a file descriptor, which is inherited by child processes — so a daemon started during the run (dockerd, on a host where systemctl forks it directly rather than starting a unit) kept the lock alive after the installer itself had exited. Re-running then reported Another install.sh holds the lock and waited out the full 300s for a run that had ended minutes earlier, with no way out but deleting the lock file — which nothing told the operator to do. The installer now records the holder's PID beside the lock and breaks a lock that no live process claims, saying so as it does. Two belts: the commands that can fork a surviving daemon no longer pass the lock descriptor to it, and the timeout message now names the lock file and how to inspect and clear it by hand.

Container images

devgrail-container
registry build 9
amd64747 MB
sha256:afb8784af62f2282efaf38029737b41e0fb473d8015c45d08302b4e94dd2de19
Download
arm64616 MB
sha256:3b19535d30d393044933095c037f4e460ea9066cda7e02158f9afc9cec1e2ca0
Download
devgrail-server
registry build 9
amd6445 MB
sha256:f9fb993789a33dc9866af7475c02c01fa12b5e1401e6e5f41c40ac169b831de4
Download
arm6444 MB
sha256:47db9e74fb1778b0995b860f4529018b30ec884e4ab81a1607a4df33f906dad2
Download

Installer files

docker-compose.yml11 KBsha256:d716c3cd9ffd1f4a87caacb8d1b444646f9cf388949d8c2805d2676981307abc
install.sh90 KBsha256:dab944a37ea72890244e3cf7a630c719567355fbe45bdc5bcdedf34d5bb67893
traefik-dynamic-http.yml5 KBsha256:e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
traefik-dynamic.yml6 KBsha256:d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
uninstall.sh10 KBsha256:d8f09fe906e13f57bc308f6f2340972a62b010c367174ec79597c86a84c706be

Signature

ecdsa-p256-sha256key f1f1eaf642454d65

One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.

Verify devgrail-container (amd64)
curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.1 -o release.json

# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload'   release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig

openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK

# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload

# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 9 amd64 afb8784af62f2282efaf38029737b41e0fb473d8015c45d08302b4e94dd2de19' payload && echo "digest is covered by the signature"
The signed payload — shown for reading, not for verifying

Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.

devgrail-release-signature-v1
release v0.4.1
asset docker-compose.yml 8 d716c3cd9ffd1f4a87caacb8d1b444646f9cf388949d8c2805d2676981307abc
asset install.sh 8 dab944a37ea72890244e3cf7a630c719567355fbe45bdc5bcdedf34d5bb67893
asset traefik-dynamic-http.yml 7 e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
asset traefik-dynamic.yml 8 d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
asset uninstall.sh 8 d8f09fe906e13f57bc308f6f2340972a62b010c367174ec79597c86a84c706be
image devgrail-container 9 amd64 afb8784af62f2282efaf38029737b41e0fb473d8015c45d08302b4e94dd2de19
image devgrail-container 9 arm64 3b19535d30d393044933095c037f4e460ea9066cda7e02158f9afc9cec1e2ca0
image devgrail-server 9 amd64 f9fb993789a33dc9866af7475c02c01fa12b5e1401e6e5f41c40ac169b831de4
image devgrail-server 9 arm64 47db9e74fb1778b0995b860f4529018b30ec884e4ab81a1607a4df33f906dad2