v0.4.49

Signedpublished September 24, 2026

What changed

Administration → About links to the open-source licenses of everything DevGrail is built with: the Go libraries in the server and the JavaScript packages in the dashboard, each with its license text in full. Workspace images carry the same for their tools in /usr/share/doc/devgrail/THIRD_PARTY_NOTICES.
The file explorer can download folders and several files at once. Select them and choose Download, or use the download button on a folder's row: they arrive as a single zip with everything inside, however large. A single file still downloads as itself.

Container images

devgrail-container

registry build 36

amd64812 MB

sha256:d5c49fd2200854cf0701411e77de1bb256492ace3ad93b5cbb1717c687ce71e9

Download

arm64678 MB

sha256:7064eb16190ec6b5685ee71d5c2926b0f0dcde60a2564e989629862e15d1c404

Download

devgrail-desktop

registry build 2

amd641.0 GB

sha256:8414e816b6d7061e466662ead54937e0c93b24499d7da35186ebff9fa7b3de25

Download

devgrail-server

registry build 73

amd6446 MB

sha256:35e8e9c4cebafa2226a3b069617e40bd415b233d8f8772898e765d990716cf6e

Download

arm6445 MB

sha256:c9ee06c8d87ac66f8d02720cd1acfff761df25dbf87f06fe6e509b007e8d30f4

Download

Installer files

docker-compose.yml22 KBsha256:f9e9dc571a02a77b699ef5f920aeb3e9e52afd1c6a32ed03310e271a7b5fa966

install.sh200 KBsha256:a9281d39a317586bddd3246db8f20578dc3f3c01064b9606da2b1cc937eb43b1

traefik-dynamic-http.yml6 KBsha256:09d88c6184e1b46b8036d79a075df5c058c8a010bce486537398b5d4b6c2936e

traefik-dynamic.yml6 KBsha256:54c85ea3c4bc1e73de71dac019e4242cdfe7320dcd1f1aa17a5d639e4dd325ac

uninstall.sh61 KBsha256:287ed1ff0ece38bd7da9d9b88d67923b48e75b934500900a0905477169a33151

Signature

ecdsa-p256-sha256key f1f1eaf642454d65

One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.

Verify devgrail-container (amd64)

curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.49 -o release.json

# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload'   release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig

openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK

# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload

# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 36 amd64 d5c49fd2200854cf0701411e77de1bb256492ace3ad93b5cbb1717c687ce71e9' payload && echo "digest is covered by the signature"

The signed payload — shown for reading, not for verifying

Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.

devgrail-release-signature-v1
release v0.4.49
asset docker-compose.yml 57 f9e9dc571a02a77b699ef5f920aeb3e9e52afd1c6a32ed03310e271a7b5fa966
asset install.sh 57 a9281d39a317586bddd3246db8f20578dc3f3c01064b9606da2b1cc937eb43b1
asset traefik-dynamic-http.yml 56 09d88c6184e1b46b8036d79a075df5c058c8a010bce486537398b5d4b6c2936e
asset traefik-dynamic.yml 57 54c85ea3c4bc1e73de71dac019e4242cdfe7320dcd1f1aa17a5d639e4dd325ac
asset uninstall.sh 57 287ed1ff0ece38bd7da9d9b88d67923b48e75b934500900a0905477169a33151
image devgrail-container 36 amd64 d5c49fd2200854cf0701411e77de1bb256492ace3ad93b5cbb1717c687ce71e9
image devgrail-container 36 arm64 7064eb16190ec6b5685ee71d5c2926b0f0dcde60a2564e989629862e15d1c404
image devgrail-desktop 2 amd64 8414e816b6d7061e466662ead54937e0c93b24499d7da35186ebff9fa7b3de25
image devgrail-server 73 amd64 35e8e9c4cebafa2226a3b069617e40bd415b233d8f8772898e765d990716cf6e
image devgrail-server 73 arm64 c9ee06c8d87ac66f8d02720cd1acfff761df25dbf87f06fe6e509b007e8d30f4