Release artifacts and digests
These are the artifacts published for KiCI v0.28.0. Pin by digest to verify you are running exactly the bits we shipped — a registry that serves substituted content fails a digest pull.
Container images
Section titled “Container images”| Image | Digest-pinned reference |
|---|---|
kici-orchestrator | quay.io/kici-dev/kici-orchestrator:0.28.0@sha256:5546eeba0c1d32630a8aa76b49bfdde9b88ed86407033b02fde228b744bd8398 |
kici-agent | quay.io/kici-dev/kici-agent:0.28.0@sha256:5c6456979d644c4a539ef09f44fb2d95395e75f46faf40280b09301d2aa7b069 |
The digest is the multi-arch manifest-list (image-index) digest, so the same
reference resolves the correct image on both linux/amd64 and linux/arm64.
Verify before you run
Section titled “Verify before you run”A digest pull fails closed if the registry serves substituted content:
podman pull quay.io/kici-dev/kici-orchestrator:0.28.0@sha256:5546eeba0c1d32630a8aa76b49bfdde9b88ed86407033b02fde228b744bd8398npm packages
Section titled “npm packages”| Package | Version | Tarball integrity |
|---|---|---|
@kici-dev/core | 0.28.0 | sha512-6r2szZQi3BBEmbl0CbKYY1074aycnBHytBx0zPZ7H9OYtsx2zN/6uCTnCfk6ugIbuaGi7FAs8Iqy/FTlgD30iw== |
@kici-dev/shared | 0.28.0 | sha512-fh2jdxDnIbIRftDQodLilNSoZ2xZ4iH5VhcXb9IiXr2R1Nzx6uBJSO21774lPXDlwoUNIXiQceRM66t/t9GDSg== |
@kici-dev/engine | 0.28.0 | sha512-0hPleDh3CNCNMqfTuWBabg35ng6qos7ZkQcvwONAczEgIRUPQzC323nztpnMQ0EjKbiNAiIVZx8M6tEbEKyD6A== |
@kici-dev/sdk | 0.28.0 | sha512-7alyKDZmoDu2QXX1MUJXDaSBoIyCBXd2n+g1Nx2vZ+dKTPIbVPxlskiOGgnACTyTAJ0tjTfACY/JpZ55PmSHoQ== |
@kici-dev/compiler | 0.28.0 | sha512-TRqSqupsXUJBKXJ94n/t8A7BcdIxYADL0aMsyg/M+kcJlMmk6f3D/JkAKWNa2Zju+w43feVkO/5j5Liz92M7AA== |
@kici-dev/orchestrator | 0.28.0 | pending registry propagation |
@kici-dev/agent | 0.28.0 | pending registry propagation |
kici | 0.28.0 | sha512-XsWvIg5PvysipuPJFIUIb7Xu5fDidsAr5hydRyRp42+cdSo7DxHGYRZ1mFL+hq5R0aAIln/4Vv31v8b0EI5vvQ== |
kici-admin | 0.28.0 | pending registry propagation |
KiCI tarballs do not carry npm-registry provenance attestations: npm mints
those from a supported CI provider’s OIDC identity, and pnpm release:prod
runs interactively from an operator workstation. The integrity hashes above and
the container manifest digests are the verification path.
Standalone packages
Section titled “Standalone packages”The v0.28.0 GitHub release carries a standalone
package of each component, full and light, for each platform, and a
SHA256SUMS file with the checksum of each package. A full package
includes Node.js and npm. A light package runs on a cached Node.js. The release
notes name the Node.js version. The KiCI packaging guide
describes the packages.
- Components:
kici-orchestrator,kici-orchestrator-standalone,kici-admin,kici-agent - Platforms:
linux-x64,linux-arm64,darwin-x64,darwin-arm64,win-x64,win-arm64
A package name has the form <component>-0.28.0-<platform>[-light].<tar.gz|zip>.
Download a package and SHA256SUMS, then verify the package before you extract it:
curl -fsSLO https://github.com/kici-dev/kici-public/releases/download/v0.28.0/kici-agent-0.28.0-linux-x64.tar.gzcurl -fsSLO https://github.com/kici-dev/kici-public/releases/download/v0.28.0/SHA256SUMSgrep " kici-agent-0.28.0-linux-x64.tar.gz$" SHA256SUMS | sha256sum -c -On macOS, use shasum -a 256 -c - in place of sha256sum -c -.