Releases and verification
Releases and verification
Every Continuum Local release is built, signed and published by one workflow in Blueprintr's agent repository, run for one version tag. Check each download against that workflow's identity before you install it.
Versions
Releases follow semantic versioning (MAJOR.MINOR.PATCH), tagged v and the
version, for example v0.2.0. Before 1.0, a minor version may change behaviour.
The version is the same in every file name, in the package metadata, in the
container tag and chart version, and in what continuum-local --version prints.
Release candidates are never offered on the download page.
The deb and rpm packages, the Windows installer, the container image and the
Helm chart are published from 0.2.0. Release 0.1.0 is the .mjs file only, for
Node.js 20.
What a release contains
Every format runs the same continuum-local-<version>.mjs file: plain,
unminified JavaScript with no runtime dependencies. The deb, rpm and MSI include
a Node.js runtime whose checksum is verified when the release is built. The
container image is built on the official Node.js image, pinned by digest.
| File | What it is |
|---|---|
continuum-local_<version>_amd64.deb, _arm64.deb | Packages for Debian and Ubuntu |
continuum-local-<version>-1.x86_64.rpm, .aarch64.rpm | Packages for RHEL, Rocky and Alma |
continuum-local-<version>-x64.msi | The Windows installer |
continuum-local-<version>.mjs | The agent, for a host with Node.js 24 or later |
continuum-local-helm-chart-<version>.tgz | The Helm chart, byte for byte the one in the registry |
config.example.json | An example configuration |
SHA256SUMS, SHA256SUMS.cosign.bundle | Checksums, and their signature |
continuum-local-<version>.mjs.cosign.bundle | A signature over the .mjs file on its own |
continuum-local-<version>.cdx.json | The SBOM, in CycloneDX 1.5 JSON |
continuum-local-<version>.sbom.att.bundle | A signed attestation binding the SBOM to the .mjs file |
continuum-local-<version>-image.cdx.json | The container image's package inventory |
continuum-local-<version>-image-amd64-vulnerabilities.json, -arm64- | The container image's vulnerability scan at release time |
continuum-local-<version>-oci-digests.txt | The container image's digest, and the chart's registry address |
PROVENANCE.txt | A readable copy of the build claims in the signing certificate. It proves nothing on its own. |
SHA256SUMS lists the packages, the installer, the .mjs file, the chart
archive, the example configuration, the SBOMs, the scan reports and the digest
file. The signature bundles and PROVENANCE.txt are not in it. The container
image, ghcr.io/blueprintr-io/continuum-local
for linux/amd64 and linux/arm64, and the chart,
oci://ghcr.io/blueprintr-io/charts/continuum-local, are in GitHub Container
Registry under the same version.
If the Windows installer fails its build or its install test, the release is
published without it and its release notes say so. Windows estates then stay on
the previous release, or run the .mjs file on Node.js 24. A release is not
published at all if the scan of its container image finds a critical
vulnerability that has a fix available.
Verify the downloads
Releases use Sigstore keyless signing. There is no long-lived signing key: each
signature is bound to the workflow file and the tag that produced it, and
recorded in Sigstore's public transparency log. Accept only this identity, the
release workflow at the tag you downloaded, issued by
https://token.actions.githubusercontent.com:
https://github.com/blueprintr-io/continuum-local/.github/workflows/release.yml@refs/tags/v<version>
A signature from any other workflow, or from a branch, is not a release.
Download SHA256SUMS, SHA256SUMS.cosign.bundle and your files from the same
release, then run, with cosign 3.x (releases are signed with cosign 3.0.6):
V=0.2.0 # the version you downloaded
cosign verify-blob \
--bundle SHA256SUMS.cosign.bundle \
--certificate-identity "https://github.com/blueprintr-io/continuum-local/.github/workflows/release.yml@refs/tags/v${V}" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing
The first command proves SHA256SUMS is the file the release workflow signed
for that tag. The second proves your downloads match it. A checksum without the
signature proves nothing, since anyone able to replace a download can replace
the checksum beside it. On Windows, compare the output of
Get-FileHash .\continuum-local-<version>-x64.msi with its line in the verified
SHA256SUMS.
The download page prints these commands, with the tag filled in, for the release you are viewing.
The container image and the chart
Both are signed by digest with the same identity:
V=0.2.0
ID="https://github.com/blueprintr-io/continuum-local/.github/workflows/release.yml@refs/tags/v${V}"
cosign verify ghcr.io/blueprintr-io/continuum-local:${V} \
--certificate-identity "$ID" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify ghcr.io/blueprintr-io/charts/continuum-local:${V} \
--certificate-identity "$ID" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
Deploy the image by the digest cosign verify prints, which is also in
continuum-local-<version>-oci-digests.txt: a tag can be moved, a digest
cannot. Each platform's image is signed as well as the multi-platform index. An
admission controller such as Sigstore policy-controller or Kyverno can enforce
the identity on every pull with this pattern:
^https://github\.com/blueprintr-io/continuum-local/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$
The .mjs file and its SBOM
cosign verify-blob \
--bundle continuum-local-${V}.mjs.cosign.bundle \
--certificate-identity "$ID" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
continuum-local-${V}.mjs
cosign verify-blob-attestation \
--bundle continuum-local-${V}.sbom.att.bundle \
--type cyclonedx \
--certificate-identity "$ID" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
continuum-local-${V}.mjs
The SBOM lists the agent's build tooling and what the packages redistribute:
the Node.js runtime, WinSW for the Windows service, and the container's base
image. The signing certificate in each bundle records the build claims
(repository, workflow, commit and run), and PROVENANCE.txt is a readable copy
of them.
Supported versions and compatibility
While Continuum Local is below 1.0, only the latest release is supported. Fixes, security fixes included, ship in a new release, and nothing is patched in place. To report a vulnerability, follow Reporting a vulnerability.
Agents and Blueprintr stay compatible across versions by these rules:
| Mechanism | What it means for you |
|---|---|
| Capabilities | On every poll the agent reports what it can do, and Blueprintr sends a job only to an agent that reported the capability the job needs. An older agent is never sent work it cannot do. A connector that needs a newer agent asks you to upgrade instead: WhatsUp Gold and Veeam Backup & Replication need 0.2.0 or later. |
| Additive changes | Fields in the protocol are only ever added. Capability names, job kinds and error codes are never reused for a new meaning. |
| Protocol version | The agent also reports a protocol version, reserved for a change that cannot be made by adding fields. Blueprintr speaks protocol 1 and accepts agents speaking protocol 1. An agent outside the accepted range is refused with HTTP 409, and its log says to upgrade Continuum Local. Blueprintr raises the oldest accepted protocol only after a deprecation window. |
Blueprintr decides what to send an agent from the capabilities it reports, not
from its version number. The panel shows the version number, and Update
available when a newer release exists. continuum-local --version prints both
the agent version and the protocol version.
Release notes
Each release's notes are on the download page, under the version line: expand Release notes for 0.2.0, or whichever version you are viewing. They give that release's verify and install commands, and say when it has no Windows installer. The page also marks the current release and shows the date each one was released.