Maran 1.0.0-beta.1

Signed release artifacts · channel beta · page generated 2026-09-23

This is a beta. Do not put somebody else's customers on it. It installs and runs and does what its screens say. Three things a hosting product must be trusted about have been exercised only in the project's own containers: no certificate has been issued by a real certificate authority, no disk limit has been enforced by a real filesystem, and no restore has been run on real hardware.

Install

curl -sSL https://get.maran.innovayse.com | sudo bash

A fresh server with root, no other control panel. Debian 12, Ubuntu 24.04 or AlmaLinux 9. The script verifies the installer package against a checksum it carries, then hands over; the installer verifies every artifact below against a signature before anything is written.

Artifacts

File	Size	SHA-256
agent-x86_64.tar.gz	2.9 MiB	`f9a57621ef349cb1bfc2df5f7f812685fb3a5a690834b18bd1ae8df2493fbadc`
api-x86_64.tar.gz	25.4 MiB	`6f367807e265d06bee9db37d692d0748c5fb815967965c0e59675a0b8468c799`
frontend-x86_64.tar.gz	340.4 KiB	`27879087ddb1a0d1e05e92b9b0b4dec6da21a99263388a74e122681ada828009`

The signed list is manifest.json with manifest.json.sig beside it, and integrity-manifest.json records every file inside the artifacts rather than only the archives.

Verifying by hand

If you would rather not pipe anything into a shell, the same thing without the pipe:

curl -O https://releases.maran.innovayse.com/installer/maran-installer.tar.gz
tar -xzf maran-installer.tar.gz
sudo bash installer/install.sh --channel beta

The public key the installer verifies with ships inside that package at installer/keys/release-signing.pub. A signature checked against a key downloaded from the same host proves only that both came from the same place — to do better, compare that key against the copy in the repository.