Agent installation and update reference

Installation trust and permissions

The install scripts and first agent binary come from cdn.kepeink.hu over HTTPS. The scripts compare the binary's SHA-256 with the release manifest when it supplies a hash, then run a version self-test before installing it. The installers do not verify the manifest's published minisign signature before this first run. Because the script, manifest, and binary all come from the same CDN, the first install still requires trust in Kepeink's release infrastructure. A checksum alone does not establish independent authorship. On Linux and macOS, explicitly pinning another version with --version also skips that checksum check.

Once running, the Go agent checks later releases against a minisign public key built into the binary. It verifies the signed manifest and the new binary's SHA-256 before applying an update. Self-update is enabled by default; use --no-auto-update on Linux/macOS or -NoAutoUpdate on Windows to disable it. A valid signature proves that a release was signed with Kepeink's key; it cannot prove what the program will do on your machine.

The standard Linux and macOS sudo command below installs a system service that runs as root. If that is more access than you want to grant, run the Unix installer with --user (without sudo) under a dedicated unprivileged account, or use the nonroot Docker image. For a public site, the static-folder guide shows a read-only mount of just the files you intend to publish. The agent also needs its tunnel token, outbound connectivity to Kepeink's edge and release CDN, and DNS. Keep the token private and revoke it in the dashboard if it is exposed. The legal notice identifies the service operator.