Topaz downloads

Current release v5.20.2, published 2026-09-26.

Install

curl -fsSL https://topaz.ooo/install.sh | sh
npx topaz

The installer reads latest.json, then downloads the build for your platform and checks it against the checksum published beside it.

Builds for v5.20.2

PlatformFileSizeSHA-256
Linux x86_64 topaz-linux-x86_64 247.3 MB c9b9c626d6f752d93ac32f3f826a94df5fc69427fe1582e06abcfcd7f09a940b
Linux arm64 topaz-linux-aarch64 241.4 MB 345e78d782eb45d8c9f7dbc1c128803ed6086f7c08eb175ef08890cfb8b0708a
macOS Intel topaz-macos-x86_64 245.2 MB f0ca7f9232de372b93675e5fbb6032153bd7cf71de99290f4a6d2034f1007a8a
macOS Apple silicon topaz-macos-aarch64 242.9 MB 03a224af353c94ff793cc69d507eda3a6ada822a8fe5d218505480db889b616a
Windows x86_64 topaz-windows-x86_64.exe 249.5 MB b5a6bb5242b3df8e3f22d31a6c706b8f7a4fad35c9156972c80184e7ab399e55

Verify what you downloaded

Fetch the checksum list, the signature over it and the public key, then check both.

curl -fsSLO https://topaz.ooo/dl/v5.20.2/checksums.txt
curl -fsSLO https://topaz.ooo/dl/v5.20.2/checksums.txt.sig
curl -fsSLO https://topaz.ooo/dl/topaz-release.pub
openssl pkeyutl -verify -pubin -inkey topaz-release.pub \
  -rawin -in checksums.txt -sigfile checksums.txt.sig
sha256sum --ignore-missing --check checksums.txt

The signature is Ed25519. The key was generated inside the release workflow and is held only as a repository secret, so no person keeps a copy of it. The matching public key is served from this domain and is the same for every release, SHA-256 796cd56440798d10d74f8bb98c4d89302bd20b7258469bd397fbdde5c6ccd0a4. Nothing about the signature is recorded in any public log.

Source

Read the published source for this release in the source browser. It is a static page. There is nothing to sign in to and nothing to click but the files.

The source this release was built from is archived as topaz-stage0-source-v5.20.2.tar.gz, 38.2 MB, SHA-256 045c5cbfed03db56bf79b9c168630c40e92cad0f9ede97d14867edb2d0820a72. Its offline reconstruction record is reconstruction.json. The source browser names the revision it was cut from, which is not always the revision a past release was built from.

Release record

The machine readable record for this release is manifest.json. The index behind this page is index.json.

Previous releases

Every published release stays at its own address. Nothing is moved or deleted when a new one arrives.