Install and artifacts

This page is the canonical artifact reference: where each artifact lives, which version to pin, and how to verify what you download. The CLI archive set inspected here is v0.2.5 per the public release listing; enrollment (trustplane enroll) requires v0.2.1 or later. v0.2.5 CLI archives are published per platform as trustplane_v0.2.5_<os>_<arch>.tar.gz with a SHA256SUMS file. The separately published adapter tag inspected is v0.2.5, Helm chart version 0.2.2, and SDK versions 0.2.3. That pinned combination passed the isolated managed-site activation and request checks described in the managed Auth Site guide; verify it against your own site’s release descriptor and runtime. For the guided first-run install path — checksum verification steps and the trustplane --help check — start with the install guide.

Current artifact posture

Artifact	Status	Notes
CLI release	Verified `v0.2.5`	Archives `trustplane_v0.2.5_<os>_<arch>.tar.gz` (darwin/linux × amd64/arm64) + `SHA256SUMS`. Enrollment requires `v0.2.1` or later. GitHub artifact attestations are unavailable for this release; verify checksums before use.
Container images	Published artifact	The adapter image tag `v0.2.5` is published to GHCR; use a digest-pinned pull. A broker container image is not part of this artifact set — the broker runs from source builds and the local demo.
Helm chart package	Published OCI artifact	Helm OCI chart version `0.2.2` (current, public on GHCR). Pin the chart version.
Go SDK module	Published Go module — pin `v0.2.3`	`github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.3` is listed on the Go module proxy.
TypeScript SDK package	Published npm package (Node.js-only) — pin `0.2.3`	npm `latest` resolves to `@trustplane/auth-sdk@0.2.3`.
Python SDK package	Published PyPI distribution — pin `0.2.3`	`trustplane-auth-sdk==0.2.3` is listed on PyPI.
Local first-request fixture	Docs utility `v0.1.3`	Versioned script, SHA256SUMS, release manifest, and source tag. This utility has its own version, separate from the CLI.
Source build	Source path	Source-oriented examples remain useful for local development and review.
Local signed bundles	Current model	Trust material and `trustplane-bundle-v1` policy bundles are generated locally, reviewed, signed, and mounted.

Download the CLI

The current CLI release is v0.2.5; enrollment requires v0.2.1 or later. The URLs below are the verified v0.2.5 listing — verify the current artifact listing on the downloads mirror/release page before pinning.

Public downloads base URL:

https://downloads.auth.trustplane.dev/trustplane/v0.2.5/

Checksum file:

https://downloads.auth.trustplane.dev/trustplane/v0.2.5/SHA256SUMS

Archive URL format:

https://downloads.auth.trustplane.dev/trustplane/v0.2.5/trustplane_v0.2.5_<os>_<arch>.tar.gz

Release manifest:

https://downloads.auth.trustplane.dev/trustplane/v0.2.5/release-manifest.json

Supported archive targets:

Platform	Archive
macOS arm64	`trustplane_v0.2.5_darwin_arm64.tar.gz`
macOS amd64	`trustplane_v0.2.5_darwin_amd64.tar.gz`
Linux arm64	`trustplane_v0.2.5_linux_arm64.tar.gz`
Linux amd64	`trustplane_v0.2.5_linux_amd64.tar.gz`

The current release does not include Windows artifacts. The release-manifest.json above is the machine-readable listing of the current archive set with per-archive SHA-256 values.

Always download SHA256SUMS, verify the selected archive, and only then unpack or run trustplane --help. See the install guide for command examples.

The public manifest reports cli_attestation=github_artifact_attestations_unavailable because GitHub artifact attestations are unavailable for this repository. The public macOS arm64 archive ran trustplane --help and the v0.1.3 local fixture after checksum verification. Read the v0.2.5 release notes for the exact provenance limitation.

Pull the container images

Adapter (published tag v0.2.5):

docker pull \
  ghcr.io/trustplane-dev/trustplane-auth-adapter:v0.2.5@sha256:7851520f47ca5d612fc8095dbb6a8861c2072f13b2dbc0b14fc7d78aec6f8d44

Do not use a mutable latest tag. Reference images only by version tag plus digest.

A broker container image is not a published release artifact — build the broker from the TrustPlane Auth source tree (make build) and publish it to your own registry if you deploy the broker sidecar. Control-signed bundle file consume requires adapter v0.1.0-rc.2 or later; the published v0.2.5 adapter supports it — see Control-signed bundle files.

Work with the Helm chart

Inspect chart metadata:

helm show chart \
  oci://ghcr.io/trustplane-dev/charts/trustplane-auth \
  --version 0.2.2

Pull the chart package:

helm pull \
  oci://ghcr.io/trustplane-dev/charts/trustplane-auth \
  --version 0.2.2

Render the generic chart profile with a pinned version and image before choosing site-specific values:

helm template trustplane-auth \
  oci://ghcr.io/trustplane-dev/charts/trustplane-auth \
  --version 0.2.2 \
  --namespace trustplane-auth \
  --set image.repository=ghcr.io/trustplane-dev/trustplane-auth-adapter \
  --set image.tag=v0.2.5 \
  --set image.digest=sha256:7851520f47ca5d612fc8095dbb6a8861c2072f13b2dbc0b14fc7d78aec6f8d44

The chart version is 0.2.2 without the leading v. This generic command uses the chart’s default legacy profile. A managed Auth Site also needs an exact target, independent signer public key, target private-key Secret, signed pull, persistent replay, bounded network rules, and controlDistribution.adapterVersion: v0.2.5 when that image is selected. See the managed Auth Site guide and Helm deployment guide. Do not use an unpinned chart version or a mutable latest version.

Install the Go SDK module

Install the Go SDK module with an explicit version — pin v0.2.3:

go get github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.3

The Go SDK signs proof-bound requests from caller code and returns adapter-ready headers. It is caller-side only: it is not a verifier, Control admin API client, gateway plugin, broker, or policy distribution path.

The Node.js-only TypeScript SDK package and the Python SDK distribution (python -m pip install trustplane-auth-sdk==0.2.3) are also available. See the SDK contract and the Go SDK.

Install the TypeScript SDK package

Install the TypeScript SDK package with an explicit version — pin 0.2.3:

npm install @trustplane/auth-sdk@0.2.3

The TypeScript SDK signs caller-side proof-bound requests from Node.js caller code and returns adapter-ready TrustPlane headers. The package is Node.js-only. It is not a verifier, enrollment client, Control API client, gateway plugin, broker, or policy distribution path, and it does not add gateway plugin or broker behavior.

The Python SDK is also available (python -m pip install trustplane-auth-sdk==0.2.3, caller-side signing only). See the SDK contract, the TypeScript SDK, and the Python SDK.

Release channels

CLI binaries: public downloads mirror backed by the reviewed GitHub Release maintainer record.
Adapter image: GHCR, digest-pinned in deployment examples. (No broker image in the current release.)
Helm chart: Helm OCI package.
Go SDK: public Go module at github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.3.
TypeScript SDK: Node.js-only npm package at @trustplane/auth-sdk@0.2.3.
Python SDK: PyPI distribution trustplane-auth-sdk==0.2.3.
CLI checksums are published as SHA256SUMS with the public downloads mirror.

What the examples assume

Quickstarts and tutorials that call make build assume a local source build. They are still useful for explaining local behavior, but install examples that use release artifacts should pin the exact artifact version, verify checksums for CLI downloads, pin image digests, and pin Helm chart version 0.2.2. The adapter tag is v0.2.5, CLI archive set is v0.2.5, and SDK packages are 0.2.3 across Go, TypeScript, and Python. Compatibility of that combination passed initial Control-signed activation on an isolated new site in an existing tenant. A fresh-account self-service run remains to be proven.

The use cases section uses the public CLI download path as the primary install reference when showing software/JWKS and cross-organization caller flows.

Client, SDK, broker, MCP, n8n, and workflow-agent authors should use the conformance vectors to check transcript-v1 canonicalization, body SHA-256, passport claim shape, bundle source rules, signer ordering, and broker IPC behavior.

Artifact safety rules

Public artifact pages must not include secrets, private keys, bearer credentials, signed request logs, live bundle JSON, private registry names, cloud-provider cluster identifiers, raw infrastructure addresses, or local machine paths.