Releases
v0.1.0-rc.1 is
Published 2026-10-24. This is a pre-release: until v1.0.0, any release may change fundamentally.
Where it runs
| Install target | Status | CPU |
|---|---|---|
| Installer ISO, for a VMware ESXi VM with a vTPM | Available | amd64 only |
| Installer ISO, nodeid variant, for a VM with no TPM | Available | amd64 only |
| cryptosctl, for Linux and macOS | Available | amd64 and arm64 |
| FleetOS Manager, Helm chart for your own Kubernetes | Available | amd64 only |
| Proxmox VE | Not yet available | None published |
| Bare metal | Not yet available | None published |
Download
Every image is unsigned on purpose: you sign it with your own key before it boots, so nothing in your chain of trust is signed by us. The Secure Boot guide covers enrolling your key and signing the image.
| File | Size |
|---|---|
cryptos-amd64-vmware-unsigned-v0.1.0-rc.1-0-gbb516a2.isoInstaller ISO, unsigned (TPM-sealed keys) | 47.3 MiB |
cryptos-amd64-vmware-nodeid-unsigned-v0.1.0-rc.1-0-gbb516a2.isoInstaller ISO, unsigned, nodeid variant (no TPM) | 47.3 MiB |
cryptos-amd64-vmware-v0.1.0-rc.1-0-gbb516a2.uki.unsignedThe UKI inside the ISO, unsigned | 22.5 MiB |
cryptos-amd64-vmware-nodeid-v0.1.0-rc.1-0-gbb516a2.uki.unsignedThe UKI inside the nodeid ISO, unsigned | 22.5 MiB |
cryptosctl-linux-amd64-v0.1.0-rc.1-0-gbb516a2cryptosctl for Linux, amd64 | 13.3 MiB |
cryptosctl-linux-arm64-v0.1.0-rc.1-0-gbb516a2cryptosctl for Linux, arm64 | 12.4 MiB |
cryptosctl-darwin-amd64-v0.1.0-rc.1-0-gbb516a2cryptosctl for macOS, Intel | 13.7 MiB |
cryptosctl-darwin-arm64-v0.1.0-rc.1-0-gbb516a2cryptosctl for macOS, Apple silicon | 12.8 MiB |
build-manifest.jsonBuild record | 720 B |
SHA256SUMSChecksums for every file above | 1.0 KiB |
All the files are on the v0.1.0-rc.1 release page.
FleetOS Manager on Kubernetes
FleetOS Manager is published as the container image ghcr.io/cryptos-pki/cryptos-manager:v0.1.0-rc.1 and the Helm chart oci://ghcr.io/cryptos-pki/charts/fleet-manager, version 0.1.0-rc.1. The Helm install guide covers the values it needs.
How to verify
Check the files you downloaded against the published checksums, on Linux or macOS:
sha256sum -c SHA256SUMS --ignore-missing
The build is meant to be reproducible, so rebuilding from the v0.1.0-rc.1 tag and comparing the hashes is an equally good check.