Releases, versioning and download verification

In plain terms: this page tells you which version to install, what you get with it, and how to check that the files you downloaded are the ones we published.

Release history

2026-11-12

Third public alpha. Breaking changes to the workflow JSON, the REST API, the MCP tools and the plugin contract are still possible before 1.0. See What’s new in alpha.4 and Migrate to alpha.4.

Supervisors: one owner for every server, session, workflow, run or node selection, with a Control dashboard.
Input requests, AI-assisted setup and a redesigned web UI.
Native server and client for Linux (amd64, arm64), macOS and Windows (amd64), plus a multi-architecture image.

Full release notes · Changelog

2026-10-30

Second public alpha. Breaking changes to the workflow JSON, the REST API, the MCP tools and the plugin contract are still possible before 1.0.

Stop an execution with a mode: DRAIN, CANCEL or KILL (REST, MCP).
Delete a session or a workflow (REST, MCP, CLI), read the execution limits, and read part of a node’s output.
WEBHOOK_TRIGGER and signed POST /hooks/{sessionId}/{path}.
Optional OTLP trace and metric export, off by default.
Per-key request limit on /mcp, and a GET /api/me endpoint.
The MCP tools work on the native server again (#773).
Known limitations: no native server for ARM, macOS or Windows yet (use Docker Desktop or WSL 2).

Full release notes · Changelog

2026-10-21

First public alpha. Expect breaking changes to the workflow JSON, the REST API, the MCP tools and the plugin contract before 1.0.

Native server for Linux amd64 (.tar.gz, .deb, .rpm), the yukta-cli client for Linux, macOS and Windows, install.sh, and the image ghcr.io/infenia/yukta:0.1.0-alpha.2.
Known limitations: no native server for ARM, macOS or Windows yet (use Docker Desktop or WSL 2); no authentication unless you set an API key, and the web UI cannot send one yet; workers connect over plain TCP by default; the MCP tools fail on the native server (#773).
0.1.0-alpha.1 was tagged but never published.

Full release notes

Versioning

Yukta follows Semantic Versioning 2.0.0. A version looks like MAJOR.MINOR.PATCH, with an optional pre-release label such as 0.1.0-alpha.2.

Tags. Every release has a git tag vX.Y.Z[-label] and a GitHub release with notes.
Pre-release order. 0.1.0-alpha.N, then 0.1.0-beta.N, then 0.1.0-rc.N, then 0.1.0.
Before 1.0. While the major version is 0, a minor release (0.2.0) can change the workflow JSON, the REST API, the MCP tools and the plugin contract. A patch release (0.1.1) only fixes bugs.
One number everywhere. The command-line client prints it with yukta-cli --version, the server reports it at /actuator/info (this endpoint needs the API key when one is set), and the image tag, the archive names and the packages carry it.
Never replaced. A published release, image tag or download is not changed afterwards. A bad release is fixed by the next one, and its notes say so.

What a release contains

Current release: 0.1.0-alpha.4.

File	What it is
`yukta-<version>-linux-amd64.tar.gz`	The native server `yukta`, the client `yukta-cli`, the licence and a sample settings file. From `0.1.0-alpha.4`, also `linux-arm64` and `darwin-amd64` (macOS)
`yukta-<version>-windows-amd64.zip`	The same for Windows: `yukta.exe` and `yukta-cli.exe`. From `0.1.0-alpha.4`
`yukta_<version>_amd64.deb`, `yukta-<version>.x86_64.rpm`	The same programs as a package, with a `systemd` service that is installed stopped. From `0.1.0-alpha.4`, also for `arm64`
`yukta-cli-linux-`, `yukta-cli-darwin-`, `yukta-cli-windows-amd64.exe`	The client alone, for each platform
`install.sh`	One-command installer, pinned to the release
`yukta-<version>-<platform>.sbom.json`	The server’s software bill of materials (CycloneDX): every library on the runtime classpath that is compiled into that binary, with its version. From `0.1.0-alpha.4`
`SHA256SUMS`, `SHA256SUMS.sigstore.json`	Checksums for every file, and a signature for the checksums
`ghcr.io/infenia/yukta:<version>`	The container image (`linux/amd64` and `linux/arm64` from `0.1.0-alpha.4`)

Supported platforms

Native servers for every row but the first arrive with 0.1.0-alpha.4; with earlier releases, use Docker there. The release workflow builds each one on a machine of its own platform and starts it against the Quickstart workflow before it is released.

Platform	Server	Client
Linux `amd64`	Native binary, packages, Docker image	Yes
Linux `arm64`	Native binary, packages, Docker image	Yes
macOS Intel	Native binary (`.tar.gz`), Docker Desktop	Yes
macOS Apple silicon	The Intel binary through Rosetta 2, or Docker Desktop. A native build needs a larger build machine and comes later	Yes, native
Windows `amd64`	Native binary (`.zip`), Docker Desktop or WSL 2	Yes
Windows `arm64`	Docker Desktop or WSL 2	Yes

The macOS and Windows binaries are not signed or notarized, so macOS Gatekeeper and Windows SmartScreen warn about a file downloaded in a browser. Verify it with the checksums and the build provenance below instead.

Image tags

Tag	Moves?	Meaning
`0.1.0-alpha.4`	Never	Exactly this release. Use it for repeatable deployments
`0.1`, `latest`	On each stable release	Only stable releases (no pre-release label) move these. Until the first stable release they do not exist

Verify a download

Check the checksum first. Put the download and SHA256SUMS in one folder:

sha256sum --check --ignore-missing SHA256SUMS

Then check the signature of the checksums file (it covers every other file). It is signed without a stored key (Sigstore keyless signing): the signature records the signer’s identity in a public log. Releases are signed by the release workflow in this repository, so check for exactly that identity (0.1.0-alpha.2 and earlier were signed by a maintainer instead; their release notes name the identity):

cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github.com/infenia/yukta/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS

Files built by GitHub Actions (the command-line client binaries and the server binary) also carry build provenance, which you can check with the GitHub CLI:

gh attestation verify yukta-cli-linux-amd64 -R infenia/yukta

The container image is signed by the same workflow, and from 0.1.0-alpha.4 it carries build provenance too (replace X.Y.Z with the version):

cosign verify ghcr.io/infenia/yukta:X.Y.Z \
  --certificate-identity-regexp '^https://github.com/infenia/yukta/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/infenia/yukta:X.Y.Z -R infenia/yukta

Report a problem

Open an issue on GitHub with the output of yukta-cli --version and the server’s /actuator/info. Security problems go through the process in SECURITY.md.

Next steps

Quickstart

Install Yukta and run your first workflow in five minutes.

Deployment

Install Yukta as a Docker image, a Linux package or an archive, or run it from source, with the profiles and build switches that shape it.

Licensing and editions

Which parts of Yukta are Apache-2.0, which are AGPL-3.0-only, what each edition includes, and what the licences mean for you.