Download MAQPNA

Command-line tools for Linux, macOS and Windows, server binaries, Linux packages, multi-arch container images and the Helm chart. Every file has a SHA256 checksum, a cosign keyless signature and an SBOM, built reproducibly from the tagged source.

Quick install

The install scripts download the CLIs (maqpna and maqpna-sovereign) for your platform from the GitHub release, check the SHA256 against the release's checksums.txt and — if cosign is installed — the signature, and install them to /usr/local/bin (or ~/.local/bin) or %LOCALAPPDATA%\Programs\maqpna\bin.

Linux and macOS

curl -fsSL https://maqpna.com/install.sh | sh
# a specific version, one binary, require a cosign signature:
curl -fsSL https://maqpna.com/install.sh | sh -s -- --version v0.1.0 --bin maqpna --cosign
# from the dl.maqpna.com mirror instead of GitHub:
curl -fsSL https://maqpna.com/install.sh | sh -s -- --mirror

Windows (PowerShell)

irm https://maqpna.com/install.ps1 | iex

Package managers

The Homebrew tap (AzmxAI/homebrew-maqpna) serves the formula from the first public release. The Scoop bucket (AzmxAI/scoop-maqpna), the winget package and the signed apt / yum repositories are planned and open later. Until then use the install scripts, the packages above or the binaries below. Package files for other architectures are listed under Linux packages.

Binaries

Every file is a GitHub release asset: https://github.com/AzmxAI/maqpna-releases/releases/download/<version>/<binary>_<os>_<arch> (.exe on Windows), with its cosign signature bundle next to it as <file>.sigstore.json and its digest in the release's checksums.txt. The mirror at https://dl.maqpna.com serves the same files in the dl.k8s.io layout, https://dl.maqpna.com/<version>/bin/<os>/<arch>/<binary>, each with a .sha256 (the hex digest) and a .sigstore.json. All binaries are static (CGO_ENABLED=0).

On the mirror, binaries larger than 25 MiB are served as a .tar.gz (or .zip) of the single binary plus LICENSE and README; GitHub serves every raw binary.

Verify downloads

Checksum

curl -LO https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/maqpna_linux_amd64
curl -LO https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/checksums.txt
grep ' maqpna_linux_amd64$' checksums.txt | sha256sum --check

curl -LO https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/maqpna_darwin_arm64
curl -LO https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/checksums.txt
grep ' maqpna_darwin_arm64$' checksums.txt | shasum -a 256 --check

Invoke-WebRequest https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/maqpna_windows_amd64.exe -OutFile maqpna_windows_amd64.exe
Invoke-WebRequest https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/checksums.txt -OutFile checksums.txt
$want = ((Select-String -Path checksums.txt -Pattern ' maqpna_windows_amd64\.exe$').Line -split '\s+')[0]
(Get-FileHash .\maqpna_windows_amd64.exe -Algorithm SHA256).Hash -eq $want   # True

On the mirror every file has a .sha256 next to it (the hex digest), e.g. https://dl.maqpna.com/v0.1.0/bin/linux/amd64/maqpna.sha256; its SHA256SUMS is the release's checksums.txt.

Signature (cosign keyless)

Release files are signed in GitHub Actions with Sigstore keyless signing: the certificate binds the signature to the workflow that built and signed the release (the identity below). There is no long-lived signing key. Verify with cosign 2.x or later:

curl -LO https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/maqpna_linux_amd64.sigstore.json
cosign verify-blob maqpna_linux_amd64 \
  --bundle maqpna_linux_amd64.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/AzmxAI/azmx-ai/\.github/workflows/maqpna-signed-release\.yml@refs/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

checksums.txt lists every release asset and is signed the same way:

curl -LO https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/checksums.txt
curl -LO https://github.com/AzmxAI/maqpna-releases/releases/download/v0.1.0/checksums.txt.sigstore.json
cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/AzmxAI/azmx-ai/\.github/workflows/maqpna-signed-release\.yml@refs/.+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing --check checksums.txt

Build provenance and SBOMs

Archives and packages carry SLSA build provenance attestations generated by GitHub Actions. Check one with the GitHub CLI:

gh attestation verify maqpna_0.1.0_linux_amd64.tar.gz --owner AzmxAI

Every archive has an SPDX 2.3 SBOM next to it (<archive>.spdx.json); container images carry their SBOM as a signed cosign attestation.

Container images

Multi-arch images (linux/amd64, linux/arm64) are published to ghcr.io/azmxai/maqpna. The runtime images are distroless and run as UID 65532.

Pin images by digest in production. Verify the signature and the SBOM attestation:

cosign verify ghcr.io/azmxai/maqpna/maqpna-gateway:0.1.0 \
  --certificate-identity https://github.com/AzmxAI/maqpna/.github/workflows/release.yml@refs/tags/v0.1.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
cosign verify-attestation --type spdxjson ghcr.io/azmxai/maqpna/maqpna-gateway:0.1.0 \
  --certificate-identity https://github.com/AzmxAI/maqpna/.github/workflows/release.yml@refs/tags/v0.1.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Helm chart

The chart is published as an OCI artifact. The values-sovereign-eu.yaml profile ships inside the chart.

helm pull oci://ghcr.io/azmxai/maqpna/charts/maqpna --version 0.1.0 --untar
helm install maqpna ./maqpna \
  --namespace maqpna-system --create-namespace \
  --set image.registry=ghcr.io/azmxai/maqpna \
  -f maqpna/values-sovereign-eu.yaml

Platform guides: Azure AKS · Amazon EKS · Google GKE · OpenShift · k3s and kind. Air-gapped clusters: see air-gapped install.

macOS notes

Release builds of the macOS binaries are code-signed with an Apple Developer ID (hardened runtime) and the .zip archives are notarized by Apple. Homebrew, the install script and curl do not set the quarantine attribute in any case. If you have an unsigned build (for example a development snapshot) and macOS refuses to open a binary downloaded with a browser, verify the checksum and signature first, then clear the attribute:

xattr -d com.apple.quarantine ./maqpna
chmod +x ./maqpna

Older releases

v0.1.0 is the first release. Older versions will be listed here, and stay available on github.com/AzmxAI/maqpna-releases/releases and at https://dl.maqpna.com/<version>/….