v0.4.6

Signedpublished August 18, 2026

What changed

Fixed

A fresh interactive install died at the admin-password question. install.sh called ask_yn from the admin-credentials prompt, but the function was defined a few hundred lines further down, next to the Docker daemon preflight that was its original caller. In a sh-style top-to-bottom script that is a plain ask_yn: command not found, and it aborted the run right after the operator had typed a username. The definition now sits with the other /dev/tty prompt helpers, above every caller. Only fresh interactive installs hit this — an upgrade, --yes, or a run with DEVGRAIL_ADMIN_PASSWORD set skips the block.

Container images

devgrail-container

registry build 14

amd64747 MB

sha256:bb3d5051d72e97db6d34d13ecb8dd436c0be6e5f6df4ab98897adeab186426f3

Download

arm64621 MB

sha256:7add40a7e14d3d059474d233c77a376c901057bcea0bb5c7cac629778f0bc656

Download

devgrail-server

registry build 14

amd6445 MB

sha256:0b56a578d0327d5595c7cac6a566546f1bb5181e4f4df2b52bcfc5ef00077800

Download

arm6444 MB

sha256:179d8a28b8e98d372daa05a020cffc58b0939264dad55da21ff9f55965c50ca4

Download

Installer files

docker-compose.yml11 KBsha256:61ecf9e19a3c6be92a1161c645fa31e0cb16795419b1b2ff84c3fafeeb21f57a

install.sh118 KBsha256:0778997357114bc291f9f1c05084fa871bc92e2c80723ff9648c9fd13068002c

traefik-dynamic-http.yml5 KBsha256:e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b

traefik-dynamic.yml6 KBsha256:d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6

uninstall.sh31 KBsha256:670dce6be818dc4b5f12f729b07324e4f6dfce8973a00a57dae96db90e863b85

Signature

ecdsa-p256-sha256key f1f1eaf642454d65

One signature covers every artifact above. It is made off this host, and neither this site nor the registry behind it can check it — that is the point, and it is why verifying it catches things a checksum from the same server cannot. How to verify it.

Verify devgrail-container (amd64)

curl -fsSL https://web-dev.trixibot.com/api/registry/releases/v0.4.6 -o release.json

# -j, not -r: -r appends a newline the signer never saw, and the check fails.
jq -j '.signature.payload'   release.json > payload
jq -r '.signature.signature' release.json | base64 -d > payload.sig

openssl dgst -sha256 -verify devgrail-release.pem -signature payload.sig payload
# -> Verified OK

# The payload must name this release, so an older signed one cannot be replayed.
head -2 payload

# ...and it must name this exact file. -qxF: whole line, literal.
grep -qxF 'image devgrail-container 14 amd64 bb3d5051d72e97db6d34d13ecb8dd436c0be6e5f6df4ab98897adeab186426f3' payload && echo "digest is covered by the signature"

The signed payload — shown for reading, not for verifying

Copy this from the manifest with jq -j, never from this page: the signature covers exact bytes, and rendering here drops the trailing newline the signer included.

devgrail-release-signature-v1
release v0.4.6
asset docker-compose.yml 13 61ecf9e19a3c6be92a1161c645fa31e0cb16795419b1b2ff84c3fafeeb21f57a
asset install.sh 13 0778997357114bc291f9f1c05084fa871bc92e2c80723ff9648c9fd13068002c
asset traefik-dynamic-http.yml 12 e344c8efd13c7d84996e2ebfbc75dcee2d995d8538c8a245c89c0e44fad0089b
asset traefik-dynamic.yml 13 d18fa561b8eb7d53b015284e0246b2d05953bf281b65269c1fae3d6883530db6
asset uninstall.sh 13 670dce6be818dc4b5f12f729b07324e4f6dfce8973a00a57dae96db90e863b85
image devgrail-container 14 amd64 bb3d5051d72e97db6d34d13ecb8dd436c0be6e5f6df4ab98897adeab186426f3
image devgrail-container 14 arm64 7add40a7e14d3d059474d233c77a376c901057bcea0bb5c7cac629778f0bc656
image devgrail-server 14 amd64 0b56a578d0327d5595c7cac6a566546f1bb5181e4f4df2b52bcfc5ef00077800
image devgrail-server 14 arm64 179d8a28b8e98d372daa05a020cffc58b0939264dad55da21ff9f55965c50ca4