Downloads

Releases, and where each one was proven.

Version 0.1.0. Everything here is signed with one key, and every package below was installed into a container of its oldest supported distribution and made to serve a request before it appeared on this page. Two rows say built, not executed — that distinction is the point.

Debian, Ubuntu, and derivatives

apt

One suite, stable, carrying every architecture. The signed-by form scopes the key to this repository alone, which is what you want and what apt-key never gave you.

curl -fsSL https://apt.xinproxy.com/keys/xin-archive-keyring.gpg \
  | sudo tee /usr/share/keyrings/xin.gpg > /dev/null

echo "deb [signed-by=/usr/share/keyrings/xin.gpg] https://apt.xinproxy.com stable main" \
  | sudo tee /etc/apt/sources.list.d/xin.list

sudo apt-get update && sudo apt-get install xin

Verified back to Debian 8 (jessie, glibc 2.19), and covering i386 as well as 64-bit.

Raspberry Pi 1, Zero and Zero W

Those are ARMv6, and Debian's armhf means ARMv7+VFP3 — a different instruction set under the same architecture name, which is why Raspberry Pi OS forked the distribution rather than adding an architecture. dpkg cannot tell the two apart, so they live in separate suites with distinct versions. Same host, same key, one different word:

echo "deb [signed-by=/usr/share/keyrings/xin.gpg] https://apt.xinproxy.com raspbian main" \
  | sudo tee /etc/apt/sources.list.d/xin.list

The raspbian suite carries 0.1.0-1+rpi1, built for ARMv6+VFP2 — checked by reading Tag_CPU_arch back out of the shipped binary, not by trusting the build flags. Pi 2 and later are ordinary armhf and belong on stable. Pi Zero 2 W is ARMv8: use arm64 on a 64-bit OS, or stable armhf on a 32-bit one.

RHEL, Rocky, Alma, Fedora

dnf / yum

sudo tee /etc/yum.repos.d/xin.repo > /dev/null <<'EOF'
[xin]
name=xin
baseurl=https://rpm.xinproxy.com/el8
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://rpm.xinproxy.com/keys/xin-archive-keyring.asc
EOF

sudo dnf install xin

Verified back to CentOS 7 (glibc 2.17) with yum, which is why the repository metadata is gzip-compressed with sqlite databases rather than the zstd a current createrepo_c emits by default — zstd metadata is unreadable to RHEL 7, silently.

Everything else

Tarballs

Static musl builds have no libc dependency at all. The glibc builds link a maximum symbol version of 2.17 — the number is chosen at build time and then read back out of the ELF, so the floor is verified rather than inherited from whichever base image was handy.

Architecture	For	Verified on	Download
`amd64`	64-bit Intel/AMD	CentOS 7, Debian 8, 9, 10, 11, Rocky 8	tar.gz
`arm64`	64-bit ARM, Graviton, Apple silicon under Linux	CentOS 7, Debian 8, 9, Rocky 8, Debian 12	tar.gz
`i686`	32-bit Intel/AMD	Debian 11 i386, installed and serving	tar.gz
`armv7`	32-bit ARM, Raspberry Pi 2 and later	built, not executed	tar.gz
`armv6`	Raspberry Pi 1, Zero, Zero W	built, not executed	tar.gz
`ppc64le`	IBM POWER, little-endian	Debian 10 (RHEL 8 floor)	tar.gz
`s390x`	IBM Z	ClefOS 7, Ubuntu 20.04	tar.gz
`amd64-musl`	Static, no libc — Alpine, distroless, scratch	Alpine 3.9 and 3.21	tar.gz

Full index, including xin-envoyd and xin-gateway. Checksums are in SHA256SUMS, signed at SHA256SUMS.asc.

What is in a release

Three binaries

Package	What it is
`xin`	The proxy. nginx configuration, nginx command line.
`xin-envoyd`	The xDS data plane, for Envoy control planes.
`xin-gateway`	The Kubernetes Gateway API controller.

The front ends are selected at compile time and deliberately do not link each other: xin-envoyd contains no nginx configuration parser, and a build gate fails if one ever appears in its dependency graph.

Signing

One key, verified end to end

RSA 4096, chosen over ed25519 because the apt and rpm of 2014 have to be able to check it.

9525 631F 0C1A C9B1 5C6F  A180 39D6 C83E 4CCC E6E0

Both repositories are signed at the metadata level (InRelease, repomd.xml.asc) and every RPM is signed individually, so repo_gpgcheck=1 and gpgcheck=1 both hold. The armoured key is at keys/xin-archive-keyring.asc, the dearmoured one at keys/xin-archive-keyring.gpg.