Downloads

Get OpenVTL™

Releases live on GitHub. Each release is a ~12 MB openvtl-<version>.tar.gz with its SHA-256 displayed on the release page, and every bundle carries SHA256SUMS plus an Ed25519 signature over it. The release you download is the complete product.

Current release

openvtl-v1.0.0.tar.gz

sha256 fdec3ebdd4c84b1848d9d7c0bed60ba2234337635eb68b31eebf664e16a9b4de

Releases on GitHub First-time operator guide

The release signing key

Every release is signed with this Ed25519 key. It is published here, out of band, so you can verify a bundle against a key that did not arrive inside it. Save the key from this page, and if you obtained a bundle anywhere other than the GitHub releases page, verify it before the installer ever runs.

Ed25519 public key · base64

WdL14ggTOB8OrxHns+ZWGrHn9hThBvJTst5Y8FigZQ0=

PEM · save as openvtl-release.pem

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAWdL14ggTOB8OrxHns+ZWGrHn9hThBvJTst5Y8FigZQ0=
-----END PUBLIC KEY-----

Fingerprint · SHA-256 of the SPKI DER

310ddeb09ab560078fd835ede9722ffecdaac2782bc96a76674c10ce3a27b5ed

Reproduce it from the PEM: openssl pkey -pubin -in openvtl-release.pem -outform DER | sha256sum

Verify a download

The installer performs this same verification before it consumes anything; running it yourself first proves the bundle is intact and authentic with nothing installed. With openvtl-release.pem saved from this page:

tar xzf openvtl-<version>.tar.gz
cd openvtl-<version>
base64 -d SHA256SUMS.sig > sig.raw
openssl pkeyutl -verify -pubin -inkey openvtl-release.pem -rawin \
    -in SHA256SUMS -sigfile sig.raw
sha256sum -c SHA256SUMS

Signature Verified Successfully followed by an OK for every file means the bundle is exactly what was signed. Any other output means stop: delete the bundle and download again from GitHub.

The commands above are for the Debian box you are installing on (OpenSSL 3.x). On macOS, use base64 -D and shasum -a 256 -c SHA256SUMS.

Update bundles come from support

Signed update bundles for running appliances are distributed through the support portal, never from this site. You download the bundle there and apply it in the appliance UI under Settings → Updates; the appliance verifies the same signature chain before touching anything.

support.openvtl.com