Reference
Download and verify RC1
Choose the 12 October 2026 package for your platform and verify it before installation.
Choose your platform
These are the complete RC1 rebuild-20261012 archives published on 12 October 2026. All four use Product source 2f6774f212e10c0f32f01be073f3f0cbe03382d7.
Open the official GitHub release. GitHub's automatic Source code downloads contain repository documents, not the Product installer.
| Platform | Complete package | Archive signature |
|---|---|---|
| Windows x64 | punaha-0.1.0-rc.1-rebuild-20261012-windows-amd64.zip | Download signature |
| Ubuntu amd64 | punaha-0.1.0-rc.1-rebuild-20261012-ubuntu-amd64.tar.gz | Download signature |
| Debian 13 amd64 | punaha-0.1.0-rc.1-rebuild-20261012-debian13-amd64.tar.gz | Download signature |
| RHEL 9 x86_64 | punaha-0.1.0-rc.1-rebuild-20261012-rhel9-x86_64.tar.gz | Download signature |
Verify before installation
- Download your platform archive and its signature. Keep the original bytes.
- Download the checksum list, its signature, and public release certificate.
- Have your administrator confirm the expected certificate fingerprint through a previously trusted channel. A certificate included in the same download is not independent proof of trust.
- Follow Verify downloads to check the signed checksum list and archive signature.
- Compare your archive's SHA256 with the verified checksum list. Stop if a signature or hash fails.
- Extract the entire archive. Follow its
INSTALL.mdto verify the platform manifest, installer, executable and included files before running them.
The release uses detached RSA signatures with SHA256. Windows publisher files also have Authenticode signatures and timestamps. The RPM has no native OpenPGP signature.
Certificates are self signed. Follow your organisation's trust policy. Never disable signature checks or place a private signing key on the installation host.
Archive SHA256 reference
Compare these with the signed checksum list. A matching hash alone does not establish publisher identity.
Windows x64
86b84ff36768f89ea5a3dd539e16c1dac125d24afb938ece1e5c231212265e82Ubuntu amd64
0eb7ed166ebdb92668c6d65256ca875ff794c7760578c025d1da313a21b45448Debian 13 amd64
67bcb3e8720c98d286499d8915dde5b4eb2aa2e676c0e554bd431c8442b1fc4bRHEL 9 x86_64
7afb4fab96c4d52a75e2890f5cf5522687eee553e7b523be168ed2d3819630e3Public certificate fingerprint reference
These are SHA256 fingerprints of the DER certificate file bytes. Confirm them independently before trusting a certificate.
Release certificate:
7f76f8e1af2fed2a5098f3f78443be95b77d4b39d1d84cbd70cd84ba29cb84b5Windows publisher certificate:
11a90675305b50a3bdca95ab8f86a821658d527d21903d81e30c873c67291275Keep the matching instructions
Keep INSTALL.md, REGISTRATION.md, RELEASE-CANDIDATE.md, VALIDATION.json, and the public certificates with the extracted platform folder.
The current licence and privacy notice versions are rc1-20261012-v1. Preserve earlier acceptance receipts and the exact documents they reference.
Install a fresh evaluation copy
This same version rebuild is not a validated in place upgrade. Use separate program files, databases and evaluation data. Preserve an existing installation and its backups.
Follow Windows installation or Linux installation. Check the release validation limits before relying on a package.
Was this page helpful?
Your answer helps us improve the documentation.
Do not include personal information, customer information, passwords, or keys.