Downloads · hashes · provenance
Bytes, and where they came from.
Every artifact listed here has a filename and a SHA-256 you can check before you run it. Nothing appears on this page until the release rail has produced and accepted it.
Accepted artifacts
No accepted artifact · verified 2026-09-08
RedFlag does not currently publish a built download. The newest tagged version is v0.2.9.5; v0.2.9.6 is described in the changelog but is not tagged and has produced no accepted artifact.
The release rail exists and runs. It has not yet handed out bytes that have passed it. Until it does, publishing a binary here would mean asking you to trust a file that nothing has checked — so the honest answer is to build from source, below.
What a build has to survive first
“Nothing has passed yet” is only meaningful if passing costs something. These are the gates in the release workflows, each named with the object it actually checks and the point at which it runs.
| Gate | When | What it checks |
|---|---|---|
| Version gate | Before build | The tag against the version constants in versions.go. A release cannot claim a version the source does not. |
| Component catalog gate | Before build | That every component the catalog declares is present in the tree being built. |
| Public history gate | Before build | The whole history behind the tag, not just the tagged commit, with a pinned gitleaks whose own download is SHA-256 checked before it runs. |
| Dependency posture | Before build | Nothing about the artifact. It produces the supply-chain posture as its own file and carries it into the build. |
| Binary version check | At build | Server, agent and helper executed with --version on Linux amd64 only. Cross-compiled targets cannot be run on the builder and are not checked this way. |
| Receipted candidate | At staging | Every file in the candidate, by recomputed SHA-256, against a receipt that cannot name itself. No symlinks, and no file present that the receipt does not list. |
| Contract verification | At publication | The staged candidate, fetched by its receipt hash rather than rebuilt, bound to the source commit, tag, builder identity, workflow and the exact CI run that produced it. |
| Ancestry check | At publication | That the commit being published is an ancestor of the public branch. Publication authority is separate from having built something. |
| Anonymous refetch | After publication | Each asset downloaded again over its public URL with no credentials, hashed, and compared to the local file — and the tag object from the public remote compared to the local tag object. |
None of that is a download. A rail can be real and the shelf still empty — these gates describe what an artifact would have to survive, not that one has. The table at the top of this page remains the only statement about what exists.
What exists per platform
An empty column is not an oversight. RedFlag builds for what it builds for, and this table says so rather than implying a grid that does not exist.
| Platform | State | Detail |
|---|---|---|
| Linux | Build from source | The most complete surface. Deep process, capability, namespace, cgroup and package-ownership inspection is Linux-first. |
| Windows | Build from source | Binaries cross-compile from Linux and an MSI installer exists in the release path. Neither has been published as an accepted release artifact. |
| macOS | Not offered | No macOS build is produced by the release rail. Nothing is planned that would be honest to announce here. |
Build it from source
The canonical public source is the Forge repository below. It is Casey-controlled and is the authority for what RedFlag actually is.
git clone https://forge.caseytunturi.com/Fimeg/RedFlag.git
cd RedFlag
# build
make
When there is a file, check it
Every artifact this page ever lists will carry its SHA-256 in the table above. Compare it against the file you received. If they differ, you did not get the artifact this page published.
sha256sum redflag-<version>-<platform>.tar.gz
A hash proves the bytes are the bytes. It does not prove they are good — only that they are the ones that were accepted and published.
While there is nothing to download
An empty shelf is not an empty project. Both pages below describe the same system to different readers, and neither one is waiting on a tag.