v0.4.51
Signedpublished October 1, 2026What changed
- The uninstaller asks what to remove. Run on a terminal without flags, it asks about one part at a time: the database and config, the workspaces, their snapshots, the TLS certificates, the images, the backup archives, whether to take a backup first, the changes install.sh made to the host, and Docker Engine. Pressing Enter always keeps the part. Removing everything except your workspaces is a yes to the first question and Enter for the rest. Before anything is deleted, it shows the resulting plan and asks once to go ahead.
- Keep the certificates, images or backups while removing the rest. New
flags
--keep-certs,--keep-imagesand--keep-backupskeep those parts through a--purge. A reinstall on the same hostname then reuses the certificates instead of ordering new ones from Let's Encrypt, skips downloading the images again, and can restore from the archives left in/opt/devgrail/backups.--remove-snapshotsremoves the snapshots of workspaces kept with--keep-workspaces. The existing flags work as before, and--yesstill runs unattended without asking anything. - Deleting a script removes it from your API keys. A key that had been
granted a script you later deleted kept a grant on nothing, and an agent
that sent the key's grants back through
update_api_keywas refused with "script not found". The same happened to keys granted the retired "Common CLI tools" built-in. Upgrading removes every grant left behind this way, for scripts and for deleted workspaces, projects and skills. - The OpenCode DevGrail controller setup script says workspaces in its description, in the help for its API key and in the next steps it prints, like the rest of DevGrail.
Container images
Installer files
Signature
ecdsa-p256-sha256key f1f1eaf642454d65
One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.
Verify devgrail-container (amd64)
curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.51 -o release.json
# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload' release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig
openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK
# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload
# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 37 amd64 3e6698c4b5051ffde7bd54564bd20b1f8ff24037169c2f64185b0438e9ef24b3' payload && echo "digest is covered by the signature"The signed payload — shown for reading, not for verifying
Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.
devgrail-release-signature-v1
release v0.4.51
asset docker-compose.yml 59 54873642ee398b1de1b9e074d88e4a89895a98d0bcc11b055707dfd4b2bc1dad
asset install.sh 59 8f7735149f7ed6b94b2963683b22cb682342527ac0ed207e3dd57dd353f3b3b4
asset traefik-dynamic-http.yml 58 09d88c6184e1b46b8036d79a075df5c058c8a010bce486537398b5d4b6c2936e
asset traefik-dynamic.yml 59 54c85ea3c4bc1e73de71dac019e4242cdfe7320dcd1f1aa17a5d639e4dd325ac
asset uninstall.sh 59 3da60ce469e6d4345e72e4e77298512a16882dfa3789ffd9d73e0e800444641d
image devgrail-container 37 amd64 3e6698c4b5051ffde7bd54564bd20b1f8ff24037169c2f64185b0438e9ef24b3
image devgrail-container 37 arm64 7af5e5db5fb3e7cb67206bcb4b84e7a71a1301d08f6bb3108b29bd2cde3d59a1
image devgrail-desktop 3 amd64 c57bea7891f59f3734b08a9006aa5410a1e3349e8077e0320ed7c6d50d038584
image devgrail-server 75 amd64 81da55e780392deb83bc70016b85a2c7a90949a47c01916ea2e3370cc604c572
image devgrail-server 75 arm64 fe6ad9c6cb16b6acce263be55bffbb5d60de4e7c33b01b4e382dd97f383c2d16