v0.4.42
Signedpublished September 16, 2026What changed
-
Videos can now be watched directly in the file explorer. MP4, WebM, Ogg, M4V and QuickTime files open in a native browser player with playback, volume and full-screen controls, while the original file remains available from the preview's download button.
-
Two of your projects can no longer share a name. A project is picked by name everywhere it is used — the project list, a workspace's project field, and the project tools an agent calls over MCP — so two of your own answering to "site" made every one of those a guess. Creating or renaming a project onto a name you already use is now refused, and the New Project dialog says so while you type rather than after you submit. Names are yours alone: another user having a "site" has never had anything to do with yours, and still does not.
If this install already had duplicates, the upgrade keeps the oldest of each set under its name and appends "(2)", "(3)" to the others; the server log names every project it renamed, and you can rename them to whatever you like from the project page.
Container images
Installer files
Signature
One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.
curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.42 -o release.json
# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload' release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig
openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK
# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload
# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 32 amd64 d6790d94e449088d214e6416d586cf88b94847632c9f20f964bfcbbd93fea612' payload && echo "digest is covered by the signature"The signed payload — shown for reading, not for verifying
Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.
devgrail-release-signature-v1
release v0.4.42
asset docker-compose.yml 50 24e32d13fc76c78de5495f59636f1bf4c651692761d4c575c09776f27cb5a029
asset install.sh 50 ee5052c1552dd5c34c2d33716aa92f6384ca7464b59ff224785ab986a102f466
asset traefik-dynamic-http.yml 49 e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
asset traefik-dynamic.yml 50 d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
asset uninstall.sh 50 abe80c2eaab7a8dd0c23073939f58487a4a0bca5a6aef303e489b2ecb2ceca40
image devgrail-container 32 amd64 d6790d94e449088d214e6416d586cf88b94847632c9f20f964bfcbbd93fea612
image devgrail-container 32 arm64 848718e58c4824bb6e56b062bd8b204ad373997145565e129f5c104b7e443e11
image devgrail-server 62 amd64 7eb830fc4a0a97948e0a255282b3b93a80b9716608bf63df173b2dbb2e794332
image devgrail-server 62 arm64 1f4f20c9d7af8d4879a5ec81be38a842ab546eb979ea93bbe5eb7f8dca7308ed