Download Zolt

Stable, preview, and zap builds for macOS and Linux.

Zolt · Install · Releases · Channels · Security

Install

curl --proto '=https' --proto-redir '=https' --tlsv1.2 -fsSL \
  https://dist.zolt.sh/install.sh | sh

The stable URL serves a reviewed bootstrap that pins an immutable GitHub-hosted installer and its SHA-256. That installer resolves the current zap release, accepts archives and checksums only from exact zoltsh/releases release URLs, verifies the archive, and records the signed channel used by zolt self update.

Choose a channel

Channel	Best for	Origin
stable	Recommended releases; not enabled yet	Signed pointer at dist.zolt.sh
preview	Protected alpha, beta, and release candidates	Signed pointer at dist.zolt.sh
zap	The latest healthy build from main	Signed pointer at dist.zolt.sh

Tip

Production builds should pin an exact version and checksum instead of following a channel.

What comes with a release

File	Purpose
Native archives	Zolt for each supported platform
SHA-256 checksums	File-integrity verification
Release manifest	Version, builder metadata, and archive identities
Release record	Source, workflow, controller, and candidate file identities
Source CI evidence	The exact successful source run used for the build
Preview tag evidence	The protected signed source tag and GitHub verification result

Release files for every channel live in immutable GitHub Releases. DigitalOcean stores the small stable bootstrap plus signed channel and release-index files that tell clients which GitHub Release is current. Preview publication is enabled through a protected source tag, isolated signing, a secretless immutable-release canary, and separate metadata promotion. Stable publication remains disabled.

About this repository

Zolt source and product development live in zoltsh/zolt. This repository contains the release workflows, policy, schemas, and operating documentation.

Read	When you need it
Release architecture	Understand the trust model and release flow
Repository setup	Configure GitHub, credentials, and channels
Incident runbooks	Respond to failed or compromised releases
Security policy	Report a vulnerability or exposed credential
Contributing	Change release code or policy

Development

scripts/check

This builds the controller, runs its tests, checks repository policy, packages the application, and validates the packaged command.

License

Apache-2.0. See LICENSE.