Download

The latest release is v1.1.1. One binary is both the relay (tsrelay serve) and the CLI developers use to receive callbacks.

Using a relay someone else runs?

Install the CLI from your relay instead, as Getting started describes: you get the version your relay runs, and tsrelay update keeps the two in step.

Binaries

Platform	Binary	Checksum
macOS, Apple silicon	tsrelay_darwin_arm64	SHA-256
macOS, Intel	tsrelay_darwin_amd64	SHA-256
Linux, x86-64	tsrelay_linux_amd64	SHA-256
Linux, ARM64	tsrelay_linux_arm64	SHA-256
Windows, x86-64	tsrelay_windows_amd64.exe	SHA-256
Windows, ARM64	tsrelay_windows_arm64.exe	SHA-256

On macOS and Linux, this downloads the binary for your machine, checks it against its SHA-256 checksum, makes it executable and puts it on your PATH:

os=$(uname -s | tr '[:upper:]' '[:lower:]')
arch=$(uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
curl -fsSLo "tsrelay_${os}_${arch}" "https://github.com/Radiergummi/tsrelay/releases/download/v1.1.1/tsrelay_${os}_${arch}"
curl -fsSLO "https://github.com/Radiergummi/tsrelay/releases/download/v1.1.1/tsrelay_${os}_${arch}.sha256"
shasum -a 256 -c "tsrelay_${os}_${arch}.sha256"
chmod +x "tsrelay_${os}_${arch}"
sudo mv "tsrelay_${os}_${arch}" /usr/local/bin/tsrelay

The macOS binaries are signed with a Developer ID and notarized. The Windows binaries aren't code-signed, so Windows may warn before running one; check its checksum or attestation instead. Every release, with its notes and older versions, is on GitHub. To run the relay, continue with Running a relay.

Container image

The relay is also published as a container image for linux/amd64 and linux/arm64. Its tags follow the release: 1.1.1, the minor and major versions, and latest.

docker pull ghcr.io/radiergummi/tsrelay:1.1.1

Each image carries a signed build provenance attestation. To verify it with the GitHub CLI:

gh attestation verify oci://ghcr.io/radiergummi/tsrelay:1.1.1 --owner Radiergummi

In a deployment, pin the image to an exact version, or to the digest you verified, rather than to 1 or latest, which move with new releases.

Ready-made deployments for Kubernetes and Docker Compose are in the repository.

Verifying a download

Each release binary comes with a SHA-256 checksum, a signed build provenance attestation, and a signed CycloneDX SBOM listing the modules it was built from. With the GitHub CLI:

gh attestation verify tsrelay_linux_amd64 -R Radiergummi/tsrelay                              # provenance
gh attestation verify tsrelay_linux_amd64 -R Radiergummi/tsrelay --predicate-type https://cyclonedx.org/bom

Without access to GitHub's API, verify against the bundles attached to the release: add --bundle tsrelay.provenance.sigstore.json or --bundle tsrelay_linux_amd64.sbom.sigstore.json. The SBOM itself is tsrelay_linux_amd64.cdx.json.