We check the signature before you download.

Desktop availability

Desktop installer availability

macOS gets the AGI Cloud desktop app (cloud accounts only) when a signed build is published. Linux x64 package assets exist, but a download is offered only after the release API verifies the matching updater signature. Windows installers have not been published, and no release dates are available for them.

• macOS

  Checking the release channel…

• Windows

  Windows installer not published

• Linux x64

  Checking the signed release channel…

CLI availability

CLI archive availability

The agi binary ships as platform archives on the CLI release channel. A download appears only for the platforms the release API confirms are published.

Release verification

A build has to prove itself before it reaches this page.

The release API answers with a manifest only when the asset URL sits on its trusted-host allowlist. A release whose URL falls outside it is answered with a 404, and this page then shows a labelled state with nothing to click. These are the checks standing behind a control on the rest of the page.

• Signed and re-checked inside the same run

  The desktop workflow builds each artifact with the release signing key, then verifies that artifact against its own .sig using the updater public key committed in this repository. A mismatch stops the release before anyone sees it.

• A draft until a clean machine can install it

  A bare Ubuntu container installs the Debian package with no build toolchain present, proves the installed binary resolves every shared library, and a second job installs the previous release, upgrades to this one, and rolls back. The release is published once all of that passes.

• macOS builds are signed, notarized, and stapled

  Both macOS jobs run codesign --verify --deep --strict against the app, confirm the Developer ID authority and hardened runtime, put the bundle through the same Gatekeeper assessment your Mac will, and validate the notarization ticket stapled onto every DMG they ship.

• CLI checksums carry a Sigstore signature

  The CLI workflow writes SHA256SUMS over every archive, signs it keyless with cosign, and verifies that bundle against the workflow identity that produced it before the release exists.

None of that has to be taken on trust. The release publishes the material you need to repeat the checks yourself, on the file you actually downloaded.

# CLI archives, against the checksum file signed in the release run
$ shasum -a 256 -c SHA256SUMS
$ cosign verify-blob --bundle SHA256SUMS.sigstore.json \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-identity https://github.com/siddharthanagula3/agiworkforce/.github/workflows/release-cli.yml@refs/tags/v-cli-<version> \
    SHA256SUMS

# the AGI Cloud desktop app, once you have moved it to Applications
$ codesign -d --verbose=4 "/Applications/AGI Cloud.app"
$ xcrun stapler validate ~/Downloads/agiworkforce-cloud.dmg

Platforms without an installer

Leave an address and we will write when a platform opens.

Some surfaces have no installer to verify yet, and each one tracks its own listing: AGI Mobile, AGI in Chrome, and AGI in VS Code. The sections above report what the release API can confirm for desktop and CLI right now.