Download and verify
Every release reaches you through your own namespace on registry.lutralabs.io, signed, with a software bill of materials. This page is the same for both packages.
1. Log in
Use the username and password you were issued:
docker login registry.lutralabs.io
The examples below use two shell variables. Set them once:
SLUG=<your-slug> # your namespace, from your registry credential
VERSION=v0.34.28 # the release you are installing
2. Download the release bundle
The bundle is one OCI artifact holding everything the scripts and the Compose install need. Download it into a directory of its own:
oras pull registry.lutralabs.io/customers/$SLUG/lutralabs/lutra-id-selfhosted-bundle:$VERSION -o lutraid
cd lutraid
| File | Purpose |
|---|---|
install.sh | Installs everything, in one command |
docker-compose.yml, .env.example, init-secrets.sh, Caddyfile | The Compose install |
verify-release.sh, mirror-images.sh | Verifying a release, mirroring it into your own registry |
images.yaml | The digests this release is pinned to. Both scripts read it |
cosign.pub | The release signing key, for verifying without internet access |
INSTALL.md, README.md | This guide and the Compose guide, as of this exact release |
Installing with Compose is then one command — ./install.sh, covered in Install with Docker Compose.
Installing with Helm? Download the bundle anyway — it carries the verification and mirroring scripts. The chart itself comes straight from the registry; its version is the release version without the v:
helm registry login registry.lutralabs.io
helm show readme oci://registry.lutralabs.io/customers/$SLUG/lutralabs/charts/lutraid --version ${VERSION#v}
3. Verify it
From the bundle directory:
./verify-release.sh $VERSION --registry registry.lutralabs.io/customers/$SLUG
For each image, the Helm chart and the bundle itself, this proves:
- the tag resolves to exactly the digest recorded in
images.yaml - a cosign signature is present and valid
- both SBOM attestations — SPDX and CycloneDX — are present and valid (images)
It ends with VERIFIED, or tells you not to install and exits non-zero.
Without internet access
The command above checks keyless signatures, which needs Sigstore's public services (Fulcio and Rekor). An air-gapped site reaches neither, so every release is signed twice — keyless, and with a long-lived key whose public half is cosign.pub in the bundle:
./verify-release.sh $VERSION --registry registry.lutralabs.io/customers/$SLUG \
--key cosign.pub --offline
If you would rather not take the key from the same artifact you are checking, fetch lutraid.lutralabs.io/cosign.pub on a connected machine and compare the two.
If your credential lapses
Pulls stop working. A running installation keeps running — nothing reaches into a deployment you operate, and your license is a separate system entirely. What you lose is the ability to fetch new versions, including security patches.