Install and update connectors
Bootstrap independent trust, install exact signed versions and retain packages needed by unfinished jobs.
Verify the base release
Windows x64 and Linux x64 GNU packages are distributed through GitHub Releases. Linux builds target Ubuntu 24.04; older glibc distributions are not qualified. Confirm release provenance and checksums before running binaries. Match release notes to your selected version; this documentation can describe changes ahead of published assets.
gh attestation verify SHA256SUMS --repo coldctl/coldctlPin trust and install
Obtain the public root.json and independently verify its fingerprint. Do not trust a root just because it was inside a downloaded bundle. Replace VERIFIED_FINGERPRINT and RELEASE_VERSION using verified release information. Select postgres, mysql or mongodb.
coldctl init
coldctl connector registry --url https://github.com/coldctl/coldctl/releases/latest/download/ --root root.json --root-sha256 VERIFIED_FINGERPRINT
coldctl connector list --available
coldctl connector install mysql --version RELEASE_VERSION
coldctl connector doctorInspect and activate
Install selects the package unless --no-activate is supplied. use changes the version for new sessions; a downgrade requires --allow-downgrade. Incomplete jobs retain their connector pins. doctor checks local integrity and known revocations without executing code or downloading. refresh verifies new signed metadata and retains revocation information.
coldctl connector inspect mysql
coldctl connector refresh
coldctl connector use mysql --version RELEASE_VERSIONOffline repositories
Extract connector-registry.zip from the verified release and pass the directory to --file. Trust bootstrap is still mandatory. A bundle is a repository directory, not a native connector executable. Approved installed packages run offline; signed metadata checks still govern installation and refresh.
coldctl connector install mysql --version RELEASE_VERSION --file ./connector-registry
coldctl connector bundle mysql --version RELEASE_VERSION --out ./offline-bundleRetention and release operation
Do not remove packages referenced by running sessions or resumable jobs. Published package identities must never be replaced. Version-tagged release automation builds and qualifies packages, checksums and signed registry assets; ordinary commits do not publish releases. Expired metadata or root trust requires a reviewed release/rotation process, never bypassing verification. Use preview bundles in separate local state to avoid changing production rollback state.