grove v0.1.6
Install
bash (macOS / Linux / Git Bash on Windows):
curl -fsSL https://raw.githubusercontent.com/alxshelepenok/grove/main/install.sh | bash
Windows PowerShell 5.1+:
iwr https://raw.githubusercontent.com/alxshelepenok/grove/main/install.ps1 -UseBasicParsing | iex
The installer verifies the signed manifest (RSA-2048/PSS) before parsing it and checks SHA-256 + size of every artifact before installing. Anti-rollback state lives in ~/.grove/.sequence.
Verify manually
Download SHA256SUMS and SHA256SUMS.sig from this release, then:
bin/verify.sh docs/security/artifacts/public-keys/grove-manifest-2026-08.pem SHA256SUMS SHA256SUMS.sig
sha256sum -c SHA256SUMS
Desktop bundles are unsigned
Browser downloads of the .msi / .dmg / .deb / .AppImage carry no publisher signature: Windows SmartScreen and macOS Gatekeeper will warn. The signed manifest and SHA256SUMS.sig above are the verification path; the script installers never trigger these prompts (command-line downloads carry no Mark-of-the-Web / quarantine attribute).
Contents
- grove and grove-mcp CLI binaries + grove-desktop portable archives: linux-x64, macos-arm64, macos-x64, windows-x64.
- Desktop OS bundles: msi + nsis (windows), dmg (macOS arm64 + x64), deb + AppImage (linux).
- Signed manifest, SHA256SUMS, CycloneDX SBOM, VEX, signed installers.