tc-releases

Public release binaries for Tangled Circuit. The source repository is private; only the built artifacts are published here.

Supported target: Linux / amd64 (the daemon is CGO-linked with the bundled liblancedb_go.so). Each release carries the verified archive, SHA256SUMS, SHA256SUMS.sig, release-signing-key.pub, release-manifest.json, sbom.cdx.json, and the installers.

Install

curl -fsSL https://perfectmachines.ai/zthor/tc-releases/raw/branch/main/install.sh | bash

One command. It resolves the latest release, downloads SHA256SUMS and its Ed25519 signature, verifies that signature against the pinned release key before it trusts any hash, verifies the installer and archive against the signed checksums, installs tc, tangled, tc-mcp, liblancedb_go.so and the pinned DuckDB CLI, adds the install directory to your shell PATH, starts the daemon, and waits for /healthz. A missing or invalid signature is a hard failure; there is no unsigned fallback.

If an existing circuit database is present, it first stops the daemon, copies the database(s) with their WAL and ~/.config/tangled to ~/backups/tc-install-<timestamp>/, verifies the copy sizes, and only then replaces binaries. TC_SKIP_BACKUP=1 opts out; --no-start skips the backup because it deliberately leaves a running daemon alone.

User-mode layout: binaries in $HOME/.local/bin, circuit state in ~/.local/share/tangled, config and operator key in ~/.config/tangled, and a systemd --user unit named tangled.service (a detached process is used when systemd --user is unavailable). No root and no fixed system paths: the default install is per-user on any Linux account.

Options:

curl -fsSL .../install.sh | bash -s -- --no-start        # install only
curl -fsSL .../install.sh | bash -s -- --prefix /opt/tc  # custom prefix
curl -fsSL .../install.sh | bash -s -- --dry-run         # print the plan and unit

On a server, run the same command as root with --system; that is the only mode that installs machine-wide (prefix /usr/local, override with --prefix) and provisions the systemd service with its own service user, /var/lib/tangled state and loopback-only listeners:

curl -fsSL https://perfectmachines.ai/zthor/tc-releases/raw/branch/main/install.sh | sudo bash -s -- --system

Environment overrides: VERSION (pin a release), PREFIX, TC_ADDR (default 127.0.0.1:9832), TC_QUACK_PORT (default 9833), TC_UNIT_NAME, TC_NO_SYSTEMD=1, TC_NO_START=1, TC_DRY_RUN=1, TC_BACKUP_DIR (default ~/backups), TC_SKIP_BACKUP=1, TC_BACKUP_ONLY=1 (take the backup and exit). A mirror with its own signing key sets both TC_RELEASE_SIGNING_PUBKEY and TC_RELEASE_SIGNING_FINGERPRINT.

Verify

Every release signs SHA256SUMS with a dedicated Ed25519 key. The signer is releases@tangledcircuit, fingerprint SHA256:vYLJ2r7EVc+O5R3VwxcbKYVj74EeUrRblTUk+SAjWck.

VERSION=0.1.6
base="https://perfectmachines.ai/zthor/tc-releases/releases/download/v${VERSION}"
curl -fsSLO "$base/SHA256SUMS"
curl -fsSLO "$base/SHA256SUMS.sig"
curl -fsSLO "$base/release-signing-key.pub"
printf 'releases@tangledcircuit %s\n' "$(cat release-signing-key.pub)" > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I releases@tangledcircuit \
  -n tangled-release -s SHA256SUMS.sig < SHA256SUMS

A good result prints Good "tangled-release" signature for releases@tangledcircuit with ED25519 key SHA256:vYLJ2.... Then check the archive:

curl -fsSLO "$base/tangled-circuit-${VERSION}-linux-amd64.tar.gz"
sha256sum -c SHA256SUMS --ignore-missing

The signature is the independent anchor: it authenticates the release against the key, not against this host. The curl | bash wrapper itself is fetched over TLS from this repository; if you need to authenticate the wrapper too, download and inspect/verify it before running it, or pin its hash from a second channel.

Manual install

install-from-release.sh is the underlying installer, published in every release. It verifies the signed SHA256SUMS before it installs anything, and it installs binaries only; the bootstrapper above is what starts and supervises the daemon.

VERSION=0.1.6 \
RELEASE_BASE_URL=https://perfectmachines.ai/zthor/tc-releases/releases/download \
bash install-from-release.sh --with-duckdb

Updating

tc self-update -y              # apply the latest release, restart, health-check
tc self-update -y -no-restart  # apply binaries only

tc self-update reads this repository's latest release, so it needs no credentials. It resolves the running installation, updates every installed binary and the bundled native library, restarts the local daemon, and restores the previous set if the new one does not come back healthy.

tc self-update does not copy the circuit database. Before a schema-changing upgrade, take a backup with the installer's backup-only mode:

curl -fsSL https://perfectmachines.ai/zthor/tc-releases/raw/branch/main/install.sh | TC_BACKUP_ONLY=1 bash