Installing Tricryption
Tricryption 8.1 ships as operating-system packages for Ubuntu, as Windows Installer packages (MSIs) for Windows Server, and as container images. Every target in the table below was qualified by installing the release on a never-touched machine of that target and taking it through install, provisioning, a key round trip, reboot, upgrade, removal and purge, each step checked from the installed system itself.
Once it is installed, Upgrading gives the order of an upgrade and what to re-set after one. Recovering a key server covers what to back up and how to restore onto a replacement host. Scaling and high availability covers running several key servers on one key database behind one address.
| Page | For |
|---|---|
| Linux (Ubuntu) | the key server, the remote engine, the Console and the REST Gateway from .deb packages |
| Amazon Web Services | the Ubuntu packages on EC2 with the key database on Amazon RDS, and the Gateway and Console on ECS Fargate |
| Google Cloud | the Ubuntu packages on Compute Engine with the key database on Cloud SQL, over a private address |
| Windows Server | the same products from three MSIs, as Windows services |
| Evaluation with Docker Compose | the whole product on one host, for evaluation only |
Supported targets
A target is Qualified only when a recorded run has installed, provisioned, upgraded and removed the release on a fresh machine of it. A different image is a different target until a run says otherwise.
Linux
| Target | Image | Kernel | glibc | systemd | PostgreSQL | Node | State | Qualified |
|---|---|---|---|---|---|---|---|---|
| Ubuntu 24.04 LTS (x86_64) | ubuntu-2404-noble-amd64-v20261009 (Google Compute Engine) | 7.0.0-1014-gcp | 2.39 | 255 | 16.15 (Ubuntu archive) | 24.22.2 | Qualified | 2026-10-12 |
Ubuntu 24.04 LTS on Compute Engine e2-standard-4 (x86_64) | ubuntu-2404-noble-amd64-v20261024 | 7.0.0-1014-gcp | 2.39 | 255 | 16.15 on Cloud SQL db-custom-2-8192, verify-full | 24.22.2 | Qualified | 2026-10-29 |
| Ubuntu 22.04 LTS (x86_64) | ubuntu-2204-jammy-v20261009 (Google Compute Engine) | 6.8.0-1070-gcp | 2.35 | 249 | 14.24 (Ubuntu archive) | 24.22.2 | Qualified | 2026-10-12 |
Ubuntu 24.04 LTS on Amazon EC2 m7i.xlarge (x86_64) | ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-20261023 | 7.0.0-1014-aws | 2.39 | 255 | 16.15 on Amazon RDS db.m7g.large, verify-full | 24.22.2 | Qualified | 2026-10-26 |
Ubuntu 24.04 LTS minimal on Amazon EC2 m7i-flex.large (x86_64) | ubuntu-minimal/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-minimal-20260925 | 7.0.0-1013-aws | 2.39 | 255 | 16.15 (Ubuntu archive) | 24.22.2 | Qualified | 2026-10-13 |
Windows
| Target | Image | Build | Windows PowerShell | PostgreSQL | Node | State | Qualified |
|---|---|---|---|---|---|---|---|
| Windows Server 2022 Datacenter (x64) | windows-server-2022-dc-v20261014 (Google Compute Engine) | 10.0.20348.5761 | 5.1 | 16.15 (EDB binaries), plain TCP | 24.22.2 (inside the MSI) | Qualified | 2026-10-20 |
| Windows Server 2025 Datacenter (x64) | windows-server-2025-dc-v20261013 (Google Compute Engine) | 10.0.26100.33650 | 5.1 | 16.15 (EDB binaries), TLS with verify-full | 24.22.2 (inside the MSI) | Qualified | 2026-10-20 |
| Windows 11 Enterprise 24H2 (x64), in Windows Sandbox | the host's own Sandbox image | 10.0.26100.9711 | 5.1 | 16.15 (EDB binaries), plain TCP | 24.22.2 (inside the MSI) | Qualified for evaluation | 2026-10-20 |
The Node.js runtime in every row moved from 24.18.0 to 24.22.2 after these targets were qualified, as a security update in an unchanged package layout. See Security advisory: the Node.js runtime (CVE-2026-111497).
The Windows 11 row covers install, provisioning, a key round trip, removal and reinstall. Windows Sandbox does not survive a restart, so reboot, upgrade and purge were not run on it: it is an evaluation target, not a server target.
Containers
The REST Gateway and Console images were qualified on Amazon ECS Fargate (platform 1.4.0, 0.5 vCPU and 1 GiB per task) on 2026-10-13, again on 2026-10-14 at the production size, and on 2026-10-20 with OpenID Connect sign-in and the delegation layer, beside a key server installed from the Ubuntu packages. The Docker Compose evaluation stack was proved on Docker Engine 29.5 with Compose 5.1 on 2026-10-13; it is not a production target.
What a release contains
| Artefact | What it is |
|---|---|
tricryption-ks_<version>_amd64.deb | the key server, tecert, tricryption-ks-provision and the tricryption-ks@.service unit |
tricryption-re_<version>_amd64.deb | the remote engine, rE: re-server, re-setup, and re-config.sh with its template |
tricryption-console-gateway_<version>_amd64.deb | the Console and the REST Gateway, their signed release manifest, tricryption-tier-provision and two units |
tricryption-node_<node version>_amd64.deb | the Node.js runtime the Console and Gateway are admitted with (24.22.2 in this release) |
| Gateway and Console container images | the two tier packages installed on Ubuntu 24.04, with no identity or secret in any layer |
| key-server container image | the key-server package on Ubuntu 24.04; it runs a provisioned key server and never provisions one |
tricryption-ks-8.1.<n>-x64.msi | the key server for Windows |
tricryption-re-8.1.<n>-x64.msi | the remote engine for Windows |
tricryption-console-gateway-8.1.<n>-x64.msi | the Console, the REST Gateway and their pinned Node.js for Windows |
deploy/compose/ | the Docker Compose evaluation stack |
SHA256SUMS, SHA256SUMS.sig, SHA256SUMS.cert.pem | the release index and its signature |
RELEASE-NOTES.md, SUPPORT-MATRIX.md, *.cdx.json | the notes, this support matrix, and a CycloneDX SBOM for each bundle |
Verifying a release
SHA256SUMS lists the SHA-256 of every artefact in the release, one <sha256> <name>
line each. SHA256SUMS.sig is a detached CMS signature over its exact bytes by the
release signer, whose certificate is SHA256SUMS.cert.pem. Verify the signature against
the release CA certificate Pi-Soft gives you:
openssl cms -verify -binary -inform DER -in SHA256SUMS.sig -content SHA256SUMS -purpose any -CAfile <release-ca.pem> -out /dev/null
It prints CMS Verification successful when the index is the one the release signer
signed. Then, in the directory that holds SHA256SUMS and the files you are about to
install, check each of them against its line:
sha256sum -c --ignore-missing SHA256SUMS
It prints <file>: OK for every file present and exits 0. A file whose bytes differ from
the signed index prints <file>: FAILED, followed by
sha256sum: WARNING: 1 computed checksum did NOT match, and the command exits non-zero:
do not install it. --ignore-missing skips the artefacts you did not download.
On Windows, in Windows PowerShell 5.1, in the same directory, check each file against its line:
$file = 'tricryption-ks-8.1.<n>-x64.msi'
Get-FileHash -Algorithm SHA256 $file
$line = Get-Content SHA256SUMS | Where-Object { $_.EndsWith(" $file") }
(Get-FileHash -Algorithm SHA256 $file).Hash -eq $line.Split(' ')[0]
Get-FileHash prints a table with the columns Algorithm, Hash and Path, where
Hash is the file's SHA-256 in upper-case hex. SHA256SUMS holds the same value in
lower case. The -eq comparison ignores case. It prints True when the file's bytes
are the ones the signed index names, and False when they differ: do not install it.
A file with no line in SHA256SUMS is not part of the release, and the last command
fails on it.
The release signer also signs the Console and Gateway's own release manifest. Keep its certificate, its CA certificate and its CRL: the tier provisioner on every platform registers the release with the key server using them.
The MSIs and the Windows executables in 8.1 are not Authenticode-signed. Their integrity
comes from SHA256SUMS and its signature above. See Windows Server.
Qualified at engine master ac4545d27c95.