Install and artifacts

This page is the canonical artifact reference: where each artifact lives, which version to pin, and how to verify what you download. The current CLI release is v0.2.4 per the signed release listing; enrollment (trustplane enroll) requires v0.2.1 or later. v0.2.4 CLI archives are published per platform as trustplane_v0.2.4_<os>_<arch>.tar.gz with a SHA256SUMS file, and the adapter image ghcr.io/trustplane-dev/trustplane-auth-adapter:v0.2.2 is the current public GHCR tag. For the guided first-run install path — checksum verification steps and the trustplane --help check — start with the install guide.

Current artifact posture

Artifact	Status	Notes
CLI release	Current release `v0.2.4`	Archives `trustplane_v0.2.4_<os>_<arch>.tar.gz` (darwin/linux × amd64/arm64) + `SHA256SUMS`. Enrollment (`trustplane enroll`) requires `v0.2.1` or later. Produced without GitHub artifact attestations — verify `SHA256SUMS` before use.
Container images	Published artifact	The adapter image is published to GHCR (current tag `v0.2.2`); use digest-pinned pulls. A broker container image is not part of the current release — the broker runs from source builds and the local demo.
Helm chart package	Published OCI artifact	Helm OCI chart version `0.2.2` (current, public on GHCR). Pin the chart version.
Go SDK module	Published Go module — pin `v0.2.2`	`github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.2` is importable through normal Go module tooling.
TypeScript SDK package	Published npm package (Node.js-only) — pin `0.2.2`	`@trustplane/auth-sdk@0.2.2` is installable through npm for Node.js callers.
Source build	Source path	Source-oriented examples remain useful for local development and review.
Local signed bundles	Current model	Trust material and `trustplane-bundle-v1` policy bundles are generated locally, reviewed, signed, and mounted.

Download the CLI

The current CLI release is v0.2.4; enrollment requires v0.2.1 or later. The URLs below are the verified v0.2.4 listing — verify the current artifact listing on the downloads mirror/release page before pinning.

Public downloads base URL:

https://downloads.auth.trustplane.dev/trustplane/v0.2.4/

Checksum file:

https://downloads.auth.trustplane.dev/trustplane/v0.2.4/SHA256SUMS

Archive URL format:

https://downloads.auth.trustplane.dev/trustplane/v0.2.4/trustplane_v0.2.4_<os>_<arch>.tar.gz

Release manifest:

https://downloads.auth.trustplane.dev/trustplane/v0.2.4/release-manifest.json

Supported archive targets:

Platform	Archive
macOS arm64	`trustplane_v0.2.4_darwin_arm64.tar.gz`
macOS amd64	`trustplane_v0.2.4_darwin_amd64.tar.gz`
Linux arm64	`trustplane_v0.2.4_linux_arm64.tar.gz`
Linux amd64	`trustplane_v0.2.4_linux_amd64.tar.gz`

The current release does not include Windows artifacts. The release-manifest.json above is the machine-readable listing of the current archive set with per-archive SHA-256 values.

Always download SHA256SUMS, verify the selected archive, and only then unpack or run trustplane --help. See the install guide for command examples.

This release was produced without GitHub artifact attestations. The GitHub Release is the maintainer record and fallback source for release review, but it is not required for public CLI archive download.

Pull the container images

Adapter (current release v0.2.2):

docker pull \
  ghcr.io/trustplane-dev/trustplane-auth-adapter:v0.2.2@sha256:9e66feae80dfcd5f33b77c4b20968ebb5efbf9d7eb216c2cef2e4df66129e356

Do not use a mutable latest tag. Reference images only by version tag plus digest.

A broker container image is not a published release artifact — build the broker from the TrustPlane Auth source tree (make build) and publish it to your own registry if you deploy the broker sidecar. Control-signed bundle file consume requires adapter v0.1.0-rc.2 or later; the current v0.2.2 adapter supports it — see Control-signed bundle files.

Work with the Helm chart

Inspect chart metadata:

helm show chart \
  oci://ghcr.io/trustplane-dev/charts/trustplane-auth \
  --version 0.2.2

Pull the chart package:

helm pull \
  oci://ghcr.io/trustplane-dev/charts/trustplane-auth \
  --version 0.2.2

Install or upgrade with the pinned chart version and digest-pinned images:

helm upgrade --install trustplane-auth \
  oci://ghcr.io/trustplane-dev/charts/trustplane-auth \
  --version 0.2.2 \
  --namespace trustplane-auth \
  --create-namespace \
  --set image.repository=ghcr.io/trustplane-dev/trustplane-auth-adapter \
  --set image.tag=v0.2.2 \
  --set image.digest=sha256:334f806bf438cb65dfbd305d1f3c7dbe18929ac866b224b874f89f9e931d1573

The chart version is 0.2.2 without the leading v. Do not use an unpinned chart version or a mutable latest version.

Install the Go SDK module

Install the Go SDK module with an explicit version — pin v0.2.2:

go get github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.2

The Go SDK signs proof-bound requests from caller code and returns adapter-ready headers. It is caller-side only: it is not a verifier, Control admin API client, gateway plugin, broker, or policy distribution path.

The Node.js-only TypeScript SDK package and the Python SDK distribution (python -m pip install trustplane-auth-sdk==0.2.2) are also available. See the SDK contract and the Go SDK.

Install the TypeScript SDK package

Install the TypeScript SDK package with an explicit version — pin 0.2.2:

npm install @trustplane/auth-sdk@0.2.2

The TypeScript SDK signs caller-side proof-bound requests from Node.js caller code and returns adapter-ready TrustPlane headers. The package is Node.js-only. It is not a verifier, enrollment client, Control API client, gateway plugin, broker, or policy distribution path, and it does not add gateway plugin or broker behavior.

The Python SDK is also available (python -m pip install trustplane-auth-sdk==0.2.2, caller-side signing only). See the SDK contract, the TypeScript SDK, and the Python SDK.

Release channels

CLI binaries: public downloads mirror backed by the reviewed GitHub Release maintainer record.
Adapter image: GHCR, digest-pinned in deployment examples. (No broker image in the current release.)
Helm chart: Helm OCI package.
Go SDK: public Go module at github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.2.
TypeScript SDK: Node.js-only npm package at @trustplane/auth-sdk@0.2.2.
CLI checksums are published as SHA256SUMS with the public downloads mirror.

What the examples assume

Quickstarts and tutorials that call make build assume a local source build. They are still useful for explaining local behavior, but install examples that use release artifacts should pin the exact artifact version, verify checksums for CLI downloads, pin image digests, and pin Helm chart version 0.2.2. The current adapter image tag is v0.2.2; the CLI and SDK packages on this page are 0.2.2 across Go, TypeScript, and Python.

The use cases section uses the public CLI download path as the primary install reference when showing software/JWKS and cross-organization caller flows.

Client, SDK, broker, MCP, n8n, and workflow-agent authors should use the conformance vectors to check transcript-v1 canonicalization, body SHA-256, passport claim shape, bundle source rules, signer ordering, and broker IPC behavior.

Artifact safety rules

Public artifact pages must not include secrets, private keys, bearer credentials, signed request logs, live bundle JSON, private registry names, cloud-provider cluster identifiers, raw infrastructure addresses, or local machine paths.