v0.4.15

Signedpublished August 24, 2026

What changed

Added

Nothing, just testing

Container images

devgrail-container

registry build 24

amd64742 MB

sha256:4657a309f66b799f8da65119896ed7953bbb700f0a9f8ef974cf0d45740ed0cf

Download

arm64612 MB

sha256:016f34061e0dabe08d72b8017ca02322e2b1f4e51f6d50ad04ff3b56d33ac283

Download

devgrail-server

registry build 25

amd6445 MB

sha256:25544d04e945c61fce017c1574f6e48d641e88edd65a736f1a20570665825b03

Download

arm6444 MB

sha256:19b3aba88f6f33cd1b8923612d9cbb6ca4c335985797abba1cc59ce274cf7ec2

Download

Installer files

docker-compose.yml16 KBsha256:25d99bfe1eb947d9f3277067aa9fa776fb3da3b8896e5fcb8737a73e2582dc31

install.sh132 KBsha256:57a946382d304d2a1deb30cc7cf9ceb760f96bf78e190d7e7e13119518d397ac

traefik-dynamic-http.yml5 KBsha256:e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b

traefik-dynamic.yml6 KBsha256:d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6

uninstall.sh31 KBsha256:d8dc586f38e0cf33eadc126d75b303c660e970e55028f60ad4e2872c40cbaa71

Signature

ecdsa-p256-sha256key f1f1eaf642454d65

One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.

Verify devgrail-container (amd64)

curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.15 -o release.json

# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload'   release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig

openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK

# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload

# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 24 amd64 4657a309f66b799f8da65119896ed7953bbb700f0a9f8ef974cf0d45740ed0cf' payload && echo "digest is covered by the signature"

The signed payload — shown for reading, not for verifying

Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.

devgrail-release-signature-v1
release v0.4.15
asset docker-compose.yml 22 25d99bfe1eb947d9f3277067aa9fa776fb3da3b8896e5fcb8737a73e2582dc31
asset install.sh 22 57a946382d304d2a1deb30cc7cf9ceb760f96bf78e190d7e7e13119518d397ac
asset traefik-dynamic-http.yml 21 e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
asset traefik-dynamic.yml 22 d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
asset uninstall.sh 22 d8dc586f38e0cf33eadc126d75b303c660e970e55028f60ad4e2872c40cbaa71
image devgrail-container 24 amd64 4657a309f66b799f8da65119896ed7953bbb700f0a9f8ef974cf0d45740ed0cf
image devgrail-container 24 arm64 016f34061e0dabe08d72b8017ca02322e2b1f4e51f6d50ad04ff3b56d33ac283
image devgrail-server 25 amd64 25544d04e945c61fce017c1574f6e48d641e88edd65a736f1a20570665825b03
image devgrail-server 25 arm64 19b3aba88f6f33cd1b8923612d9cbb6ca4c335985797abba1cc59ce274cf7ec2