Download
Production-style release artifacts with verification-first install steps. Always verify checksums before running.
Project status
SunLionet is currently an MVP/alpha. Linux bundles (`.tar.gz` + `.deb`) are the primary supported path. Android builds publish a signed release APK. Always verify checksums and the signed checksum bundle before installing.
Recommended download (manual selection)
Pick the correct artifact for your machine, verify it, then install in steps. Auto-detection is conservative and never hides other options.
Detected
Unknown • amd64
Detection is inconclusive in this environment.
Platform
Choose a platform
Auto-detection is inconclusive. Use the platform grid and verify before running.
Recommended artifact
No matching artifact for this platform/role. Use source build or choose a different platform from the grid.
Quick install (stepwise)
Select a supported platform to generate commands, or use the source build path below.
Platform grid
All primary artifacts and recommended methods. Nothing is hidden; you can always override the recommendation.
Linux x86_64
Static bundle for Linux x86_64. Includes install script + systemd unit.
SupportMVP path
MethodTarball + verify SHA256 + install script
Linux arm64
Static bundle for Linux arm64 (servers, SBCs). Includes install script + systemd unit.
SupportMVP path (arm64)
MethodTarball + verify SHA256 + install script
Raspberry Pi (ARM64)
Uses the Linux arm64 Inside bundle (gateway use).
SupportExperimental
MethodTarball + verify SHA256 + install script
Android (Termux)
Inside supports a signed APK sideload flow and a Termux CLI fallback.
SupportExperimental
MethodAPK + verify SHA256/signature + sideload
Source code
Build from source (best fallback when your platform is not covered).
SupportAlways available
Methodgit clone or tag tarball + go build
Verification
Verification protects you against corruption and tampering in transit. It does not magically make software “safe”.
What the SHA256 check gives you
- - File integrity: you got exactly the bytes the publisher intended to publish.
- - Tamper detection: if a mirror/CDN modifies the file, the check fails.
- - A consistent hash value you can compare across mirrors and friends.
- - Signature validation (`cosign verify-blob`) confirms checksums were signed by a trusted release key.
What it does not guarantee
- - No guarantee of anonymity or safety in your threat model.
- - No guarantee the binary is bug-free or appropriate for your local legal risk.
- - If an attacker controls both the binary and checksum source, checksums alone are not enough.
Platform-specific commands
Linux
sha256sum -c <file>.sha256 cosign verify-blob --key checksums.pub --signature checksums.sig checksums.txt
macOS
shasum -a 256 -c <file>.sha256
Windows (PowerShell)
certutil -hashfile <file> SHA256
For bundle authenticity (publisher signatures enforced by the agent), see /docs/outside/verification.
Installation paths
Choose the flow that matches your skill level and risk tolerance.
Quick path
Use the recommended artifact and the stepwise commands above. Intended for experienced users who still verify checksums.
Careful verified path
Verify SHA256, verify `checksums.txt` signature with cosign, and cross-check key fingerprint from a second trusted channel.
Source build path
Build from source if your platform is not covered. Use the repository-backed docs for build tags and Go toolchain details.
Build (example)
git clone https://github.com/kaveh8866/sunlionet-core
cd sunlionet-core
mkdir -p bin
go build -tags inside -ldflags="-s -w -X main.version=v0.1.0" -o bin/sunlionet-inside ./cmd/inside/
go build -tags outside -ldflags="-s -w -X main.version=v0.1.0" -o bin/sunlionet-outside ./cmd/outside/
bashRequires Go toolchain as pinned in go.mod
Limitations / readiness
Truthful constraints so users can make informed decisions.
What works today
- - Linux bundles with install script + systemd service (Inside/Outside).
- - Linux `.deb` packaging for amd64 hosts.
- - Bundle signature verification and strict parsing in the agent (trust is local and explicit).
- - Android signed release APK and Android/Termux Inside CLI path.
What is still experimental
- - Optional RPM packaging (builds only when rpm tooling is available).
- - Full multi-maintainer release-signing policy and rotation tooling.
- - Broader cross-device Android validation across OEMs/ROM variants.
Fallback sources
If a platform artifact or metadata is missing, these are the safe next steps.
Available targets in this release
android-arm64, darwin-arm64, linux-amd64, linux-arm64, windows-amd64