v0.4.59

Signedpublished October 14, 2026

What changed

Database upgrades keep migrations in numeric order. Migration 1000 and later run after 999, preserving the order of existing migrations.
Limit app subdomains by IP address. In the Domains tab, allow individual IPv4/IPv6 addresses or CIDR ranges when adding a subdomain or editing it. Add an optional inline comment such as 203.0.113.10 #Kalles IP to remember who an address belongs to; comments are kept in saved lists and snapshots. The IP access panel shows the saved status; choose Edit IP access to make changes, then Save IP access or Remove IP restriction to apply them. Unsaved changes are clearly marked. Saving does not restart the workspace. The restriction also gates sign-in pages, workspace bypasses and HTTP redirects; excluded sources get 404. REST, MCP and snapshot restores preserve the same policy.
Manage deployment backups from Administration. Create, list, download and delete database/configuration archives; choose daily, weekly or monthly backups and optional retention. Downloads require your password. Restore remains a host command, and workspace files still need separate backups. The Manage backups link has a bordered button style and backup icon so it is easier to spot in the Deployment card.
Dark mode applies before the dashboard first appears. Theme initialization now works with the installed dashboard's security policy, fixing a flash of the light theme and a blocked-script error in the browser console.
Passwords stay hidden during installation. Typing an admin password and its confirmation no longer echoes the characters when installing with curl | bash.

Container images

devgrail-container

registry build 41

amd64853 MB

sha256:2f4e28dc59dd04f37f4414569cac7d5166e6e7e78d4636422fa6246b33281ee9

Download

arm64717 MB

sha256:463e6def84e50544425b898edf607a8dc696a5794aef90e1ce571d8ee2e14853

Download

devgrail-server

registry build 85

amd6447 MB

sha256:76e22e27013788944b624227851749a9065d596edd428ec4ccfd6e31b1d76ae6

Download

arm6445 MB

sha256:304be81d46d848d3a4815afe149cd309f03a5230ea3ebb916ed4b28646f2d426

Download

Installer files

devgrail-desktop-files.tar.gz31 KBsha256:2f2bf722f47a45ee336dd9c9d76b984cb53840a8584b4a4e915543b247fe42bc

devgrail-desktop-install.sh46 KBsha256:f6dc82abc6b0624660adb45d6e234f1bc5b93f2e030e1cf39a976234f939efeb

devgrail-desktop-linux-amd6411 MBsha256:fea2b777056a2848c2444222fde43c228176bc87f502fb2ab03aea547fead294

devgrail-desktop-linux-arm649.9 MBsha256:95d07fc3eae0e4f6f6ae31321725809bf2ee6edffc670b19d024e97d042b148f

docker-compose.yml28 KBsha256:f8bdae0485cfec7269b86aec82a25dd503f8adfbe2c264a5b64d9bc7db4770b9

install.sh248 KBsha256:6c2489f409cbedbcf6dd959e2482736338453dd185cc6cf9edd96a7d5d65bf83

traefik-dynamic-http.yml7 KBsha256:787e7e7ff8099a2dc084b4204a68f7f666561b5adf709ec7f859f9fae34d9163

traefik-dynamic.yml8 KBsha256:3fe40a3d1c61b71aacd1db9b5e20132c8e69d19d44e5f193f8a27375ed921273

uninstall.sh83 KBsha256:c19a0132111a7d2d58dc6200c7ba1b29c11481077a765979cfaaaae091a31c2a

Signature

ecdsa-p256-sha256key f1f1eaf642454d65

One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.

Verify devgrail-container (amd64)

curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.59 -o release.json

# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload'   release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig

openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK

# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload

# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 41 amd64 2f4e28dc59dd04f37f4414569cac7d5166e6e7e78d4636422fa6246b33281ee9' payload && echo "digest is covered by the signature"

The signed payload — shown for reading, not for verifying

Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.

devgrail-release-signature-v1
release v0.4.59
asset devgrail-desktop-files.tar.gz 8 2f2bf722f47a45ee336dd9c9d76b984cb53840a8584b4a4e915543b247fe42bc
asset devgrail-desktop-install.sh 8 f6dc82abc6b0624660adb45d6e234f1bc5b93f2e030e1cf39a976234f939efeb
asset devgrail-desktop-linux-amd64 8 fea2b777056a2848c2444222fde43c228176bc87f502fb2ab03aea547fead294
asset devgrail-desktop-linux-arm64 8 95d07fc3eae0e4f6f6ae31321725809bf2ee6edffc670b19d024e97d042b148f
asset docker-compose.yml 69 f8bdae0485cfec7269b86aec82a25dd503f8adfbe2c264a5b64d9bc7db4770b9
asset install.sh 69 6c2489f409cbedbcf6dd959e2482736338453dd185cc6cf9edd96a7d5d65bf83
asset traefik-dynamic-http.yml 68 787e7e7ff8099a2dc084b4204a68f7f666561b5adf709ec7f859f9fae34d9163
asset traefik-dynamic.yml 69 3fe40a3d1c61b71aacd1db9b5e20132c8e69d19d44e5f193f8a27375ed921273
asset uninstall.sh 69 c19a0132111a7d2d58dc6200c7ba1b29c11481077a765979cfaaaae091a31c2a
image devgrail-container 41 amd64 2f4e28dc59dd04f37f4414569cac7d5166e6e7e78d4636422fa6246b33281ee9
image devgrail-container 41 arm64 463e6def84e50544425b898edf607a8dc696a5794aef90e1ce571d8ee2e14853
image devgrail-server 85 amd64 76e22e27013788944b624227851749a9065d596edd428ec4ccfd6e31b1d76ae6
image devgrail-server 85 arm64 304be81d46d848d3a4815afe149cd309f03a5230ea3ebb916ed4b28646f2d426