v0.4.46
Signedpublished September 23, 2026What changed
- Admins can upgrade DevGrail from the dashboard. When a newer release is
available, Administration > About has an "Upgrade to vX.Y.Z" button. It asks
for your password and hands the upgrade to a small helper the installer sets
up on the host. The helper checks the release signature and the new
installer's checksum, then runs the installer. It backs up first and rolls
back on its own if the new version doesn't come up healthy. The page follows
the upgrade through the server restart and shows the installer's output. It
can only upgrade: downgrades and rollbacks still happen from a root shell.
The helper needs systemd and is set up the next time you run the installer
from a shell. Turn it off with
--dashboard-upgrades=no. - The optional desktop image can be installed from Administration > Container images. When it isn't on the host, its row has an Install button. It uses the same host helper as dashboard upgrades.
- The installer asks whether to download the desktop image on an interactive
install of an amd64 host. The default answer is no, and the installer
remembers a no. Unattended installs still skip it unless you pass
--desktop-image=yes.
Container images
Installer files
Signature
ecdsa-p256-sha256key f1f1eaf642454d65
One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.
Verify devgrail-container (amd64)
curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.46 -o release.json
# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload' release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig
openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK
# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload
# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 35 amd64 9020aa8337f6b63afd7a8e54b07267cdc51a0ca901453f6b13a09b020042b230' payload && echo "digest is covered by the signature"The signed payload — shown for reading, not for verifying
Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.
devgrail-release-signature-v1
release v0.4.46
asset docker-compose.yml 54 f9e9dc571a02a77b699ef5f920aeb3e9e52afd1c6a32ed03310e271a7b5fa966
asset install.sh 54 a9281d39a317586bddd3246db8f20578dc3f3c01064b9606da2b1cc937eb43b1
asset traefik-dynamic-http.yml 53 09d88c6184e1b46b8036d79a075df5c058c8a010bce486537398b5d4b6c2936e
asset traefik-dynamic.yml 54 54c85ea3c4bc1e73de71dac019e4242cdfe7320dcd1f1aa17a5d639e4dd325ac
asset uninstall.sh 54 287ed1ff0ece38bd7da9d9b88d67923b48e75b934500900a0905477169a33151
image devgrail-container 35 amd64 9020aa8337f6b63afd7a8e54b07267cdc51a0ca901453f6b13a09b020042b230
image devgrail-container 35 arm64 e6cc907ce93f056f8fc8b2f7b23cbbe3b50bad19da53f4a790ff8ef8cbfec239
image devgrail-desktop 1 amd64 68bf04883024d21245a452d69128bcc6604894a49b963c50cdf2df034e4cf409
image devgrail-server 70 amd64 c7649c6735a7b1287156d2217bc7b38a29da1f181e4ff36dc47002f27d7a45a3
image devgrail-server 70 arm64 e2a716470c596a33f9a7186f4355b4f0721941f5f8421f843271d8d49d21f408