v0.4.54
Signedpublished October 5, 2026What changed
- Add a desktop to any workspace. A new desktop add-on puts a full
desktop into a workspace you already have, with no desktop image and no
dashboard setting. In the workspace's terminal, run the command on the
DevGrail website's
/desktoppage (curl -fsSL …/desktop/install.sh | bash), add a subdomain for port 26080 under the workspace's Subdomains, open it and sign in with the workspace's SSH password. You get XFCE with Firefox, sound and microphone, clipboard and file drop, scaling and settings that follow your computer, and RDP to the same session through an SSH tunnel. The desktop can be turned off from its own menu to free its memory, and turned on again after signing in. Running the command again upgrades it, anddevgrail-desktop uninstallremoves it. The installer checks everything it downloads against the release signature, like DevGrail's own installer. - Workspaces run on Ubuntu 26.04 LTS. The workspace image moves from
Ubuntu 22.04 to 26.04, so the system tools inside a workspace are current:
Python 3.14, Git 2.53 and OpenSSH 10.2 among them. Existing workspaces keep
their files and get the new system when they are created again from the
updated image. One difference to know about:
pip installoutside a virtual environment now refuses to install into the system Python, as it does on every Ubuntu since 23.04. Usepython3 -m venv, or pass--break-system-packageswhere a system-wide install is really wanted. The SSH server now also slows down each address that keeps failing to log in. - Updates shows the desktop image. On a host with the optional desktop image installed, the Updates card under Administration now lists which release it came from and whether a newer build of it is published, next to the server and the workspace image.
- Desktop sound no longer stutters in a background tab. The desktop's sound used to break up when its tab was hidden, or while the picture kept the page busy, because the browser slows a hidden page down. The sound now runs apart from the page, so neither affects it. When the network is uneven, the viewer now buffers a little more sound instead of breaking up again and again, and goes back to the shortest delay once things settle. Gaps and restarts fade in and out instead of clicking.
- The microphone keeps its delay short in long calls. A voice chat in the desktop could fall further and further behind: any hiccup on the way added delay to the microphone that stayed until it was turned off. Now the delay stays under a fraction of a second. A desktop workspace created before this release gets this part once it is created again from the updated desktop image.
Container images
Installer files
devgrail-desktop-files.tar.gz41 KB
sha256:b9d14cd5f6d5be8c2f6046e08ab887816722b15387bbfa139c79688ce2f4eed7devgrail-desktop-install.sh45 KB
sha256:3d71dc3502dcf48ed1c874757f6c4d724f78945f7e66b3ff6854cbbfa5f8b3e0devgrail-desktop-linux-amd649.5 MB
sha256:697702071c4d4ff88a76a2eefe2fc3d2ac94be67460b7569cf8f92b4e0ec528fdevgrail-desktop-linux-arm648.9 MB
sha256:1ba539f63f51801dbeadff1f115462a06696247947ab38a484eeff4e220f406cSignature
ecdsa-p256-sha256key f1f1eaf642454d65
One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.
Verify devgrail-container (amd64)
curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.54 -o release.json
# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload' release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig
openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK
# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload
# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 39 amd64 a036e3d21179e4df89df973415fde1f113f0d8c2d9013eaf47fde23bde81fc77' payload && echo "digest is covered by the signature"The signed payload — shown for reading, not for verifying
Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.
devgrail-release-signature-v1
release v0.4.54
asset devgrail-desktop-files.tar.gz 1 b9d14cd5f6d5be8c2f6046e08ab887816722b15387bbfa139c79688ce2f4eed7
asset devgrail-desktop-install.sh 1 3d71dc3502dcf48ed1c874757f6c4d724f78945f7e66b3ff6854cbbfa5f8b3e0
asset devgrail-desktop-linux-amd64 1 697702071c4d4ff88a76a2eefe2fc3d2ac94be67460b7569cf8f92b4e0ec528f
asset devgrail-desktop-linux-arm64 1 1ba539f63f51801dbeadff1f115462a06696247947ab38a484eeff4e220f406c
asset docker-compose.yml 62 dee267b0c918e08a48a703deb8d1e8d8126f90499e9cb1a660aec872a3d8480c
asset install.sh 62 9f0f79f9d9edc36f38760d08fb742fc6bccce67bb048156cfb60f8a70faeb394
asset traefik-dynamic-http.yml 61 09d88c6184e1b46b8036d79a075df5c058c8a010bce486537398b5d4b6c2936e
asset traefik-dynamic.yml 62 54c85ea3c4bc1e73de71dac019e4242cdfe7320dcd1f1aa17a5d639e4dd325ac
asset uninstall.sh 62 c017513540a9601876951e3bb4aca3390596c9c9790b189d8ec7c4e35a16a373
image devgrail-container 39 amd64 a036e3d21179e4df89df973415fde1f113f0d8c2d9013eaf47fde23bde81fc77
image devgrail-container 39 arm64 10f2fd3dd399ad1ac3e42ce986788704ca5e414a9a5506db4654a1e26dffe45b
image devgrail-desktop 5 amd64 f40c462d0847dc9532e399e7cc023e5967898770d53dd5bad13e3ae3d7dc333a
image devgrail-server 78 amd64 455e699202c0d2f9a06484894b6bb5d222bd3d0cf1f581ab924a85fc007b38d9
image devgrail-server 78 arm64 32636e65997b418f7c20ae1a38f6a05bdabfb7a31310570725ecc7752af42153