Download Fendix
Signed binaries, Linux packages, and multi-arch Docker images. Picks the right artifact for your platform automatically.
v3.5.0-rc.1
Choose your operating system and processor below.
All artifacts for v3.5.0-rc.1
Linux
macOS
Signatures, certificates and SBOMs
- macOS Apple Silicon (CycloneDX SBOM)
- macOS Apple Silicon (certificate)
- macOS Apple Silicon (signature)
- macOS Apple Silicon (certificate)
- macOS Apple Silicon (provenance)
- macOS Apple Silicon (provenance)
- macOS Apple Silicon (signature)
- macOS Apple Silicon (SPDX SBOM)
- macOS Apple Silicon (certificate)
- macOS Apple Silicon (signature)
Other
Signatures, certificates and SBOMs
Docker
docker pull fendixapp/fendix:3.5.0-rc.1Multi-arch manifest — picks linux/amd64 or linux/arm64 automatically.
Homebrew
brew tap Fendix-app/fendix && brew install fendixView the official Fendix Homebrew repository.Verify a downloaded binary
Release binaries use keyless cosign signatures (Sigstore Fulcio + GitHub Actions OIDC). Download the matching .crt and .sig sidecars, then verify the binary:
cosign verify-blob \ --certificate fendix-v3.5.0-rc.1-linux-amd64.crt \ --signature fendix-v3.5.0-rc.1-linux-amd64.sig \ --certificate-identity "https://github.com/Fendix-app/Fendix/.github/workflows/release.yml@refs/tags/v3.5.0-rc.1" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ fendix-v3.5.0-rc.1-linux-amd64
Verify the Docker image
Pin the verified v3.4.1 digest and require the official Fendix organization workflow identity. The same identity must sign the image, CycloneDX SBOM, and SLSA provenance.
IMAGE=docker.io/fendixapp/fendix DIGEST=sha256:88783a1a032f925630bdb0977b37821add5e3381d347f91ec101401f4e98e02a REF="$IMAGE@$DIGEST" IDENTITY='^https://github.com/Fendix-app/Fendix/.github/workflows/release.yml@refs/heads/main$' ISSUER='https://token.actions.githubusercontent.com' cosign verify \ --certificate-identity-regexp "$IDENTITY" \ --certificate-oidc-issuer "$ISSUER" \ "$REF" cosign verify-attestation --type cyclonedx \ --certificate-identity-regexp "$IDENTITY" \ --certificate-oidc-issuer "$ISSUER" \ "$REF" cosign verify-attestation --type slsaprovenance1 \ --certificate-identity-regexp "$IDENTITY" \ --certificate-oidc-issuer "$ISSUER" \ "$REF"
Existing users may continue pulling the previous personal GHCR image temporarily. New installations should use fendixapp/fendix. No retirement date has been announced.