Skip to content

Download

  1. Choose a release

  2. Choose a platform

    PlatformLinuxWindows
    Architectureamd64arm64
  3. Download and verify

    aembit_agent_cli_linux_arm64_1.32.4999.tar.gzLinux · arm64 · 7.4 MB.sha256.sha256.sig
    Download
    Verify this downloadsha256 + gpg
    1. Fetch the artifact and its sidecars

      Every release ships a bare-hash checksum and a detached GPG signature over that checksum.

      curl -O https://releases.aembit.io/agent/1.32.4999/linux/arm64/aembit_agent_cli_linux_arm64_1.32.4999.tar.gz
      curl -O https://releases.aembit.io/agent/1.32.4999/linux/arm64/aembit_agent_cli_linux_arm64_1.32.4999.tar.gz.sha256
      curl -O https://releases.aembit.io/agent/1.32.4999/linux/arm64/aembit_agent_cli_linux_arm64_1.32.4999.tar.gz.sha256.sig
    2. Import Aembit’s signing key

      One time per machine.

      curl -sS https://keybase.io/aembit/pgp_keys.asc | gpg --import
    3. Check the signature on the checksum

      This proves the checksum came from Aembit and was not altered in transit.

      gpg --verify aembit_agent_cli_linux_arm64_1.32.4999.tar.gz.sha256.sig aembit_agent_cli_linux_arm64_1.32.4999.tar.gz.sha256
      gpg: Signature made …
      gpg: Good signature from "Aembit, Inc. <keybase@aembit.io>" [unknown]
      Primary key fingerprint: EA3D 8D2F DAC6 BD81 3716  3D00 D655 E647 29BC 67D7
    4. Compare the artifact against the checksum

      These files hold a bare hash with no filename, so shasum -c needs the two-column form rebuilt first.

      echo "$(cat aembit_agent_cli_linux_arm64_1.32.4999.tar.gz.sha256)  aembit_agent_cli_linux_arm64_1.32.4999.tar.gz" | shasum -a 256 -c -
      aembit_agent_cli_linux_arm64_1.32.4999.tar.gz: OK
    Expected digest
    8c4407e0a2babe07019503dbfc40526024a32fe0704f254f2ab53324e025a16a

All releases

14 Aembit CLI releases in total. Select a version to update the steps above.

VersionReleasedNotesLinux amd64Linux arm64Windows amd64
1.34.5772latest2026-08-27Add a glibc-linked Linux amd64 archive alongside the default musl build
1.32.49992026-06-04Add AWS (instance metadata or IAM role) and Kubernetes Trust Provider authentication to credentials get alongside OIDC tokens; add X.509 certificate retrieval for the X.509-SVID Credential Provider through a new client private-key option; add HTTP/2 keepalive options
1.31.47642026-05-02Add upstream HTTP proxy support; add --client-workload-id flag and OIDC token expiration validation; add support for gathering dynamic claims from environment variables
1.31.46702026-04-17Add upstream HTTP proxy support for Aembit Cloud and Server Workload traffic
1.30.44332026-03-11No CLI code changes; build pipeline and artifact signing updates only
1.29.42982026-02-26Internal changes to process identification and assessment caching shared with Agent Proxy; no CLI-visible change
1.28.40632026-01-16Internal changes shared with Agent Proxy; no CLI-visible change
1.27.38652025-12-04Extend attestation gathering with VMware network attestation and Client Workload binary hashing; dependency updates
1.26.36392025-10-21Toolchain and dependency cleanup
1.25.36002025-10-02No CLI code changes; rebuilt with updated base image and dependencies
1.25.34942025-08-22Print help when run with no subcommand; add the sh environment-variable output format; clearer error messages when an OIDC token is missing or credential retrieval fails
1.24.33282025-07-29
1.17.02024-09-18
1.13.02024-03-27