Aembit CLI releases
Download
Choose a release
VersionOlder releaseReleased 2025-07-291.24.3328
Choose a platform
Download and verify
aembit_agent_cli_windows_amd64_1.24.3328.zipDownloadVerify this downloadsha256 + gpg
Fetch the artifact and its sidecars
Every release ships a bare-hash checksum and a detached GPG signature over that checksum.
curl -O https://releases.aembit.io/agent/1.24.3328/windows/amd64/aembit_agent_cli_windows_amd64_1.24.3328.zip curl -O https://releases.aembit.io/agent/1.24.3328/windows/amd64/aembit_agent_cli_windows_amd64_1.24.3328.zip.sha256 curl -O https://releases.aembit.io/agent/1.24.3328/windows/amd64/aembit_agent_cli_windows_amd64_1.24.3328.zip.sha256.sigImport Aembit’s signing key
One time per machine.
curl -sS https://keybase.io/aembit/pgp_keys.asc | gpg --importCheck the signature on the checksum
This proves the checksum came from Aembit and was not altered in transit.
gpg --verify aembit_agent_cli_windows_amd64_1.24.3328.zip.sha256.sig aembit_agent_cli_windows_amd64_1.24.3328.zip.sha256 gpg: Signature made … gpg: Good signature from "Aembit, Inc. <keybase@aembit.io>" [unknown] Primary key fingerprint: EA3D 8D2F DAC6 BD81 3716 3D00 D655 E647 29BC 67D7Compare the artifact against the checksum
PowerShell. The .sha256 file holds only a hash, so compare the two values directly.
$want = (Get-Content aembit_agent_cli_windows_amd64_1.24.3328.zip.sha256).Trim() $got = (Get-FileHash -Algorithm SHA256 aembit_agent_cli_windows_amd64_1.24.3328.zip).Hash.ToLower() if ($got -eq $want) { "OK" } else { "MISMATCH" }
Expected digest782a0ce928626f94c48f3f1f5154ddc94d921f9e850d779e230f282867313c43
All releases
14 Aembit CLI releases in total. Select a version to update the steps above.
| Version | Released | Notes | Linux amd64 | Linux arm64 | Windows amd64 |
|---|---|---|---|---|---|
| 1.34.5772latest | 2026-08-27 | Add a glibc-linked Linux amd64 archive alongside the default musl build | ✓ | ✓ | ✓ |
| 1.32.4999 | 2026-06-04 | Add AWS (instance metadata or IAM role) and Kubernetes Trust Provider authentication to credentials get alongside OIDC tokens; add X.509 certificate retrieval for the X.509-SVID Credential Provider through a new client private-key option; add HTTP/2 keepalive options | ✓ | ✓ | ✓ |
| 1.31.4764 | 2026-05-02 | Add upstream HTTP proxy support; add --client-workload-id flag and OIDC token expiration validation; add support for gathering dynamic claims from environment variables | ✓ | ✓ | ✓ |
| 1.31.4670 | 2026-04-17 | Add upstream HTTP proxy support for Aembit Cloud and Server Workload traffic | ✓ | ✓ | ✓ |
| 1.30.4433 | 2026-03-11 | No CLI code changes; build pipeline and artifact signing updates only | ✓ | ✓ | ✓ |
| 1.29.4298 | 2026-02-26 | Internal changes to process identification and assessment caching shared with Agent Proxy; no CLI-visible change | ✓ | ✓ | ✓ |
| 1.28.4063 | 2026-01-16 | Internal changes shared with Agent Proxy; no CLI-visible change | ✓ | ✓ | ✓ |
| 1.27.3865 | 2025-12-04 | Extend attestation gathering with VMware network attestation and Client Workload binary hashing; dependency updates | ✓ | ✓ | ✓ |
| 1.26.3639 | 2025-10-21 | Toolchain and dependency cleanup | ✓ | ✓ | ✓ |
| 1.25.3600 | 2025-10-02 | No CLI code changes; rebuilt with updated base image and dependencies | ✓ | ✓ | ✓ |
| 1.25.3494 | 2025-08-22 | Print help when run with no subcommand; add the sh environment-variable output format; clearer error messages when an OIDC token is missing or credential retrieval fails | ✓ | ✓ | ✓ |
| 1.24.3328 | 2025-07-29 | ✓ | ✓ | ✓ | |
| 1.17.0 | 2024-09-18 | ✓ | ✓ | – | |
| 1.13.0 | 2024-03-27 | ✓ | ✓ | – |
Related resources
New to Aembit CLI? View the install and deploy guide.
Configuring Aembit CLI? View the environment variable reference.
Looking for what changed? View Aembit CLI in the changelog.