Download and verify SoAI releases

Open the official SoAI repository, select Releases, and download the required Core files. A numbered Core release set includes its platform artifacts, exact SHA-256 sidecars, the primary V1 JSON release manifest, the separately signed macOS (experimental) and Windows-archive V1 manifests, their Ed25519 signatures, and an upload inventory. The source ZIP and TAR files that GitHub generates are source snapshots, not runnable products or update payloads.

Choose the product artifact

SoAI Connect has a separate repository, version, signing identity, and release path. Its APK and checksum are not part of the SoAI Core signed manifest. See Install SoAI Core for the supported installation path on each platform.

SoAI OS is not yet available and is not currently distributed, so no appliance release set is published. An appliance release set uses the SoAI-OS-<version>-linux-complete.zip archive, and its manifest and inventory use the same SoAI-OS-<version> prefix, so Core and appliance files never share one verification directory. Contact info@soai.to to join the waitlist; joining does not grant a license or promise an availability date.

Verify authenticity and integrity

A matching checksum detects accidental or malicious file changes only if the checksum itself is trusted. The signed manifests authenticate the release artifacts and bind artifact names, platforms, sizes, hashes, archive roots, and every regular file in each complete archive. The separately signed Windows-archive V1 manifest authenticates the Windows complete ZIP without changing the exact primary V1 automatic-update manifest shape. Compare the production public-key fingerprint with a trusted source copy:

e0333589b1ca792397182cc3f843989c021a056c61e281f8456c1da4f479f2a7

Run the offline verifier

From a trusted existing installation or complete source tree with its managed runtime installed, place the exact release set in one directory. Run the verifier from the installation or source-tree root with the edition, release version, Core version, pinned public key, and expected fingerprint:

Linux and macOS (experimental)

PYTHONPATH=backend soai_main_venv/bin/python -m app.updater.offline_release_verification \
  --artifacts-directory /path/to/release-files \
  --version <version> \
  --core-version <core-version> \
  --edition soai-core \
  --public-key backend/app/updater/release_public_key.txt \
  --expected-public-key-sha256 e0333589b1ca792397182cc3f843989c021a056c61e281f8456c1da4f479f2a7

Windows PowerShell

$env:PYTHONPATH = "backend"
.\soai_main_venv\Scripts\python.exe -m app.updater.offline_release_verification `
  --artifacts-directory C:\path\to\release-files `
  --version <version> `
  --core-version <core-version> `
  --edition soai-core `
  --public-key backend\app\updater\release_public_key.txt `
  --expected-public-key-sha256 e0333589b1ca792397182cc3f843989c021a056c61e281f8456c1da4f479f2a7

The verifier accepts --edition soai-os for an appliance release set, with the SoAI OS and Core version values that belong to that release.

The verifier fails closed if an expected file is missing or extra, the key fingerprint differs, the signature is invalid, an artifact or sidecar differs, a platform payload is incomplete, or an archive inventory does not match. Proceed only after it prints that the signature, checksums, artifacts, and archive inventories are valid.

Use the in-application updater

With Software updates (SOFTWARE_UPDATE), open the Settings menu at the right of the header in the SoAI WebUI, then Updates. On supported Linux and macOS installations, SoAI verifies the matching signed manifest and selected archive before applying it. Windows verifies the primary manifest and hands off the current x64 installer. See Updating SoAI for the complete backup, installation, and recovery workflow.

Related documentation

• Security updates and vulnerability reporting
• Release notes and upgrade notices
• SoAI Connect overview