Six verified release archives.

Every tagged release produces self-contained archives with the Nift dashboard embedded in the Trestle binary.

Verified by default

install.sh, download.sh and update.sh each verify the selected archive against the release SHA256SUMS before extracting it and fail closed on a missing checksum file, a missing exact entry, a malformed entry or a corrupted archive. The checksum tool is sha256sum with a shasum -a 256 fallback on macOS.

Download into this directory

curl -fsSL https://trestle.cv/download.sh | sh
./trestle version

Prerelease builds

curl -fsSL https://trestle.cv/download.sh | sh -s -- --version v0.1.0-rc.1

Prereleases (vX.Y.Z-*) are published as GitHub prereleases and must be selected explicitly by version; the unversioned latest commands select the stable v0.1.5 release and intentionally ignore prereleases.

For direct verification of a manually downloaded archive:

sha256sum -c SHA256SUMS
./trestle version

The version command reports the injected version, source commit, build date, Go version, operating system and architecture. Release automation also publishes build provenance for the generated artifacts.

Verified releases

Stable v0.1.5 is the current public-preview release. The unversioned installers resolve the latest stable GitHub release. The detailed evidence below is retained for the earlier releases whose verification identifiers are recorded in this documentation.

Stable v0.1.2 is a prior public-preview release. It was created from reviewed commit 91c6441: the release workflow run 33818618083 packaged the six archives plus SHA256SUMS, verified every checksum, attested build provenance, and created a normal non-draft non-prerelease release with stable-public-preview wording. The permanent read-only release-verification workflow (33818989370) then confirmed the exact seven-asset set, verified every SHA256SUMS entry, ran constrained gh attestation verify provenance on every archive, and confirmed the body wording - read-only, no edits.

Stable v0.1.1 was the prior patch release (reviewed commit 745fd0a, release workflow run 33482843753, read-only verification 33483410282); its compiled artifacts passed functional, packaging, checksum and provenance verification. Stable v0.1.0 established the initial public compatibility contract and was verified through its own release and read-only verification runs; its historical evidence is retained in the battle-tested ledger and the original release. v0.1.0-rc.1 remains a prerelease.

Archive contract

Each archive contains the executable, README and license beneath one versioned directory. Runtime assets are embedded; Nift, Node and Go are not deployment dependencies.

Release-candidate matrix

CP23 rebuilds all six archives, verifies their checksums and layout, executes the Linux amd64 artifact, runs user installation, update and rollback drills, and starts a clean instance from source-built output. The v0.1.0-rc.1 clean-machine release rehearsal passed on a fresh GitHub-hosted runner: every checksum verified, build provenance verified for all six archives against the pinned release workflow, and the public download, install and first-run paths exercised end-to-end. Read the support boundary before deploying.